The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill acts as an inbox manager, ingesting untrusted data from multiple external sources including Email, WhatsApp, Slack, Telegram, Discord, and Notion to perform context-aware drafting.
Ingestion points: Untrusted content enters the agent context in SKILL.md via tools such as wacli messages list, gog gmail thread get, Slack MCP search tools, Telegram MCP dialog lists, Discord REST reads (ops-discord read), and Notion comment fetches (notion-get-comments).
Boundary markers: The skill instructions do not specify any delimiters or explicit boundary markers to separate untrusted external content from the system prompt, nor does it provide warnings to the model to ignore embedded instructions.
Capability inventory: Across SKILL.md, the agent has access to several high-privilege capabilities including the Bash tool for arbitrary command execution and various messaging tools (SendMessage, wacli send, mcp__gog__gmail_send, mcp__claude_ai_Notion__notion-create-comment) for automated delivery of drafted content.
Sanitization: There is no evidence of sanitization, escaping, or filtering of the external message content before it is interpolated into the agent's context for drafting.
[DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file uses the dynamic context injection syntax to execute a local script and initialize context data at skill load time.
Evidence: ! ${CLAUDE_PLUGIN_ROOT}/../../bin/ops-unread 2>/dev/null || echo '{}'.
[COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool in SKILL.md to run CLI utilities (wacli, gog, ops-unread, ops-discord) and manage system services via launchctl kickstart.
[EXTERNAL_DOWNLOADS]: The CHANNELS.md file provides detailed instructions for users to install external CLI tools and MCP servers from third-party repositories and registries.
Details: Documentation references fetching the wacli and gogcli tools from GitHub repositories (github.com/steipete/*) and installing several MCP-related NPM packages.

ops-inbox