The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from external emails (audit requests) through a Gmail workflow. This creates a vulnerability where an attacker could embed malicious instructions in an email to influence the agent's behavior, especially given its access to sensitive files.
Ingestion points: External emails identified by the 'audits' Gmail label as described in the Workflow section of SKILL.md.
Boundary markers: The skill lacks explicit instructions to treat email content as untrusted or to ignore embedded instructions, although it does include a 'Mandatory Verification' checklist for data accuracy.
Capability inventory: The agent has read access to the local file system (Markdown, Excel, CSV, PDF) and the ability to draft and manage labels for emails.
Sanitization: No sanitization or filtering logic is specified for the content extracted from the audit request emails.- [DATA_EXFILTRATION]: The skill's primary function involves accessing and summarizing highly sensitive business documents, including cap tables (shareholder names, equity stakes, cost basis), financial statements (revenue, cash position, burn rate), and insurance policies. While these are necessary for the skill's business purpose, the consolidation of this sensitive data within the agent's context and the capability to draft/send external emails creates an exfiltration surface.
Evidence: SKILL.md and references/company-info.md instruct the agent to use 'cap-table-YYYY-MM-DD.xlsx', 'financials-YYYY-QX.md', and banking details as source data for drafting external responses.

investor-audits