The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The agent is vulnerable to indirect prompt injection because it processes untrusted messages from Slack and has the capability to execute commands and push code to GitHub.
Ingestion points: Untrusted data enters the agent context through the Slack connector trigger defined in infra/agents/ask-cargo.ts.
Boundary markers: The system prompt in infra/agents/ask-cargo.prompt.ts lacks explicit boundary markers or instructions to disregard embedded commands in user messages.
Capability inventory: The agent can execute CLI commands (cargo-ai), create pull requests, and push commits to GitHub (infra/agents/ask-cargo.prompt.ts).
Sanitization: There is no evidence of sanitization or filtering of Slack message content before it is processed by the harness.
[DYNAMIC_EXECUTION]: The evaluation script evals/contract.mjs uses dynamic loading with computed paths to import local resources for validation.
Evidence: await import(../infra/agents/ask-cargo.ts?contract=${stamp}); in evals/contract.mjs. While this is part of the test suite and limited to local files, dynamic importing of files via computed strings is a risky pattern.
[DATA_EXFILTRATION]: The configuration in infra/agents/ask-cargo.ts allows the agent to answer in all Slack channels where the bot is present, which could lead to accidental exposure of sensitive repository data.
Evidence: allChannels: true in infra/agents/ask-cargo.ts. If the bot is invited to a Slack Connect or public channel, internal data from context/, infra/, and workspace usage metrics could be disclosed. The skill author includes prompt-level warnings and documentation to mitigate this, but the technical configuration remains broad.

ask-cargo