The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it processes and acts upon content retrieved from an external third-party interface (ChatGPT Pro responses).
Ingestion points: Remote response data and page content from the in-app browser (referenced in SKILL.md).
Boundary markers: The skill provides explicit instructions to treat browser content as untrusted input and to ignore any instructions within that content that request credentials, privilege escalation, or unauthorized actions.
Capability inventory: The agent has permissions to read local files, modify source code, and execute local tests and builds.
Sanitization: No automated sanitization is specified; the skill relies on the agent's ability to filter input based on the provided instructions.
[DATA_EXFILTRATION]: The skill is designed to share local project context and source code snippets or archives with an external service.
It includes security-conscious instructions to exclude sensitive files such as .env files, API keys, private keys, and git history from the uploaded context.
This data sharing is the primary functional purpose of the skill and requires explicit user activation ($gpt-pro-collab).
[COMMAND_EXECUTION]: The agent is authorized to execute local commands for testing and building code received from the external source.
These capabilities are scoped to project verification (e.g., linting, unit tests) and are used to ensure the integrity of the integrated code.

gpt-pro-collab