The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions frequently require the agent to ingest and summarize data from external, potentially untrusted sources, which creates a risk for indirect prompt injection attacks.
Ingestion points: The skill explicitly directs the agent to pull information from Slack posts, Google Drive documents, company emails, Calendar event attachments, and external press articles as described in examples/3p-updates.md, examples/company-newsletter.md, and examples/faq-answers.md.
Boundary markers: The instructions lack specific guidance for the agent to use delimiters or ignore embedded instructions within the ingested text, increasing the likelihood that the agent might follow malicious commands hidden in a Slack message or document.
Capability inventory: The primary capability is data aggregation and text generation. While the skill does not request shell execution or file-writing tools, the generated communications (newsletters, FAQs) could be used to propagate malicious instructions to other employees if the agent is manipulated by the source data.
Sanitization: There are no instructions for sanitizing or escaping content retrieved from external tools before it is interpolated into the final communication drafts.

internal-comms