The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted text content from external newsletters and Telegram posts and interpolates it into a prompt for scoring and summarization.
Ingestion points: Content is pulled from Gmail and Telegram in scripts/ingest.py.
Boundary markers: The config/wow_prompt.txt template uses weak delimiters (e.g., ### Candidate 1) but does not include explicit instructions for the model to ignore potential commands embedded in the content.
Capability inventory: The results are used to update the user's daily markdown notes and the skill invokes shell commands via subprocess.run to interact with the llm CLI.
Sanitization: No sanitization or filtering for injection tokens is performed on the ingested snippets before they are placed in the prompt.
[DATA_EXFILTRATION]: To personalize the digest, the skill reads sensitive user data from ~/Brains/brain/, including the user's focus document, recent research notes, and daily note headers. This data is transmitted to an external LLM provider via the llm CLI. This behavior is documented as a primary feature of the skill.
[COMMAND_EXECUTION]: The skill relies on subprocess.run in scripts/ingest.py and scripts/wow_score.py to call external binaries including gws, llm, and a local tg.py script. While the arguments are passed as a list to minimize shell injection risk, the skill depends on the security and availability of these external tools.
[EXTERNAL_DOWNLOADS]: scripts/enrich.py extracts URLs from ingested content and sends them to the Firecrawl API (api.firecrawl.dev) for scraping. This process involves transmitting potentially sensitive URLs from private feeds to a third-party service.

wow-digest