The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill systematically reads and processes data from external, attacker-controlled environments (GitHub pull requests/issues, M365 emails, Slack messages, Google Workspace). If an external source contains malicious instructions (e.g., inside an email or a GitHub issue comment), it can pollute the agent context.
Ingestion points: Processes data from GitHub (list_pull_requests, search_pull_requests), Slack channels, M365 (ask_work_iq), and Google Workspace (Gmail, Drive, Calendar).
Boundary markers: The skill does not implement or mandate strict boundary delimiters or instructions to ignore nested prompt overrides in the ingested content.
Capability inventory: File reading (~/.config/roundup/config.md), file writing (~/Desktop/roundup-*.md), and interactive tool execution across multiple collaboration platforms.
Sanitization: No sanitization or escaping mechanisms are specified for the aggregated external texts before they are processed during synthesis.
[COMMAND_EXECUTION]: The instruction references local file management capabilities, instructing the agent to read config files and write markdown summaries directly to the file system (~/Desktop).

roundup