The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes and transmits message content which serves as an ingestion point for potentially untrusted data.
Ingestion points: Untrusted data enters the agent context through the message parameter in send, edit, and reply actions, as well as via message context associated with messageId and replyTo fields.
Boundary markers: Absent. The skill instructions do not provide delimiters or specific guidelines for the agent to distinguish between message text and executable instructions.
Capability inventory: The skill possesses capabilities for network transmission (sending messages), file system access (reading local files for attachments), and modification of existing conversation state (edit/unsend).
Sanitization: Absent. There is no mention of escaping, filtering, or validating the content of messages before they are processed or transmitted.
[DATA_EXFILTRATION]: The sendAttachment action provides the agent with the ability to read local files via the path parameter and transmit them externally.
Evidence: The skill documentation explicitly instructs the use of a path for local files in the sendAttachment action (e.g., "path": "/tmp/photo.jpg"). While this is a primary function of a messaging tool, it defines a capability that could be used to exfiltrate sensitive files (such as SSH keys or configuration files) if the agent is manipulated into doing so.

bluebubbles