The Agent Skills Directory

[PROMPT_INJECTION]: The skill is designed to ingest and process large volumes of third-party content (email archives, document dumps, etc.), which inherently exposes the agent to indirect prompt injection. Malicious instructions within the processed data could attempt to hijack the agent's logic during the triage or extraction phases.
Ingestion points: Third-party text archives described throughout SKILL.md (emails, documents, transcripts, chat logs).
Boundary markers: The skill explicitly references an untrusted-quoted fence and uses a metadata flag (untrusted_directives: true) to isolate extracted content.
Capability inventory: The skill performs file writes to multiple local directories (originals/, personal/, etc.) and makes multiple LLM calls. No dangerous subprocess or dynamic code execution capabilities were identified.
Sanitization: Implements a 'Privacy Wall' using deterministic string matching and regex to redact sensitive patterns (credentials, medical info, legal info) before any content is sent to an LLM.
[DATA_EXFILTRATION]: While the skill primarily operates on local archives and writes to local directories, the processing of sensitive data (PII, credentials, medical records) via external LLM tiers presents a potential exposure risk if the redaction logic fails or is bypassed.
Evidence: SKILL.md defines sensitive patterns like r'(api[_-]?key|password|PRIVATE KEY)' for redaction, but the 'Deep Read' prompt specifically requests the model to 'Extract EVERYTHING of value' and provide verbatim excerpts.
[COMMAND_EXECUTION]: The skill instructions utilize platform-specific CLI tools for configuration and model resolution.
Evidence: SKILL.md includes commands such as gbrain models and gbrain config set models.tier.deep opus for environment setup.

two-tier-extraction