The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process untrusted messages from external platforms like Discord and Slack. This architecture creates a significant surface for indirect prompt injection attacks, where a participant in the group chat could issue instructions intended to override the agent's safety guidelines or hijack its capabilities.
Ingestion points: External messages are continuously fetched and processed via the read and long-poll commands described in SKILL.md.
Boundary markers: The instructions do not define clear delimiters or use structured formatting to separate external message content from the agent's internal system instructions.
Capability inventory: The agent has the ability to execute shell commands (the bridge script), perform network operations (sending messages to chat APIs), and read local files (via the bridge's file-handling arguments).
Sanitization: There is no evidence of sanitization, filtering, or validation of the message content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill requires the agent to run shell commands in the background to maintain a persistent connection to the messaging platforms, which increases the agent's execution surface.
[REMOTE_CODE_EXECUTION]: SETUP.md suggests a configuration step that involves running a Deno script directly from a GitHub URL (https://raw.githubusercontent.com/dtinth/discord-message-proxy/main/tools/agent-bridge/discord-agent-bridge.ts). While this resource is owned by the skill's author, it represents a remote code execution pattern.
[DATA_EXFILTRATION]: The bundled discord-agent-bridge.ts script includes --file and --attach arguments that explicitly allow the agent to read local files and upload them to the external chat platform. If an attacker successfully uses indirect prompt injection to command the agent to "attach" a sensitive file (e.g., .env or SSH keys), the tool provides a direct path for exfiltration.

gangprompting