The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources (LinkedIn posts and comments) which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: linkedin_posts model (which syncs LinkedIn posts) and the searchPostComments action in infra/agents/listener.prompt.ts.
Boundary markers: Absent. The system prompt does not use specific delimiters or instructions to isolate the external content from the agent's core logic.
Capability inventory: The agent has access to slack.postMessage to send data to a channel and surfaced_posts to write to a ledger.
Sanitization: Absent. The agent is instructed to quote the first sentence of comments verbatim without sanitization or escaping.
[DYNAMIC_EXECUTION]: The evaluation script evals/contract.mjs uses dynamic imports to load and verify the CDK resource graph.
Evidence: Use of await import() with a cache-busting timestamp to load local project files (../infra/agents/listener.ts) for testing and validation purposes.

social-listening