The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from Slack threads to guide its investigation and implementation of fixes. Ingestion points: Untrusted data enters the agent context via slack_read_thread as described in SKILL.md. Boundary markers: The skill lacks explicit instructions or delimiters to treat thread content as data rather than instructions, potentially allowing a user in the thread to influence the agent's behavior through embedded commands. Capability inventory: The skill has broad capabilities, including modifying local source code, writing/deleting files, and interacting with the operator and external messaging platforms. Sanitization: No validation or sanitization of the Slack thread content is performed before processing.
[COMMAND_EXECUTION]: The skill is designed to modify the local codebase and may run code or tests during the investigation phase, although it is instructed to vet such actions with the operator first.
[DATA_EXFILTRATION]: The skill reads potentially sensitive files including source code, documentation, and agent context files (like .agents/, CLAUDE.md, and memory/) and posts summaries of its findings to an external channel (Slack).

look-into-it