The Agent Skills Directory

[PROMPT_INJECTION]: The skill documentation explicitly addresses prompt injection risks by prohibiting topic content in URLs and enforcing a strict slug format for topic identifiers resolved from local storage.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it ingests untrusted external data.
Ingestion points: External data is ingested via the read_article tool and from local brain files in $BRAIN_ROOT/topics/ based on user-provided IDs in SKILL.md.
Boundary markers: Documentation does not mention specific delimiters for marking the boundaries of ingested topic or article content.
Capability inventory: The skill has access to tools including search_brain, read_brain_page, read_article, and web_search as defined in SKILL.md.
Sanitization: The skill incorporates PII filtering via scripts/check-no-pii-in-agent-voice.sh and uses specific prompt constraints to prevent reading sensitive identifiers aloud.
[EXTERNAL_DOWNLOADS]: The read_article capability allows the fetching of remote content from URLs for summarization. This is a core functional feature of the logistics assistant.
[DATA_EXPOSURE]: The skill is designed to read sensitive user data (calendars, tasks, recent messages) from the local 'brain' to perform its intended logistics functions. It includes specific mitigations such as a persona-level ban on reading PII aloud.

voice-persona-venus