The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, creating a surface for instructions embedded in emails or documents to influence agent behavior.
Ingestion points: The skill reads emails via gws-gmail and processes files via gws-drive as described in SKILL.md.
Boundary markers: There are no explicit delimiters or instructions to ignore embedded content provided in the workflow instructions.
Capability inventory: The skill has permissions to send emails (gws gmail +send), upload files (gws drive +upload), and perform administrative actions (gws admin).
Sanitization: While the instructions suggest using a --sanitize flag for PII, there is no technical enforcement or validation routine described for the ingested content itself.
[PRIVILEGE_ESCALATION]: The skill utilizes administrative tools that allow for sensitive account modifications.
Evidence: The metadata and instructions in SKILL.md explicitly enable and describe the use of gws admin for creating user accounts and resetting passwords.

persona-hr-coordinator