The Agent Skills Directory

[PROMPT_INJECTION]: The skill interpolates user-provided $ARGUMENTS directly into the invocation string for the manifest-dev:figure-out skill. This pattern can lead to argument injection if the platform does not strictly validate the input, allowing a user to potentially add unauthorized flags or modify the command structure.
[DATA_EXFILTRATION]: The skill is designed to ingest and process data from Slack channels and threads involving multiple parties. This creates a surface for indirect prompt injection, where an adversary participating in the Slack discussion could embed instructions to manipulate the agent's logic or exfiltrate context from the deliberation.
Ingestion points: Multi-party deliberations within Slack channels or threads.
Boundary markers: No specific delimiters or "ignore instructions" warnings are defined in the wrapper to separate user deliberation content from system instructions.
Capability inventory: The skill (via the underlying figure-out core) can read Slack history, post messages, and access documentation or logs unless specifically disabled by flags.
Sanitization: There is no evidence of sanitization, escaping, or filtering of the Slack message content before it is processed by the agent's orchestration logic.

figure-out-team