The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external, untrusted sources including call transcripts (Fathom, Gong, Granola), Slack exports, and verbatim customer quotes. These ingestion points (the meetings/, customer-language/, sales-objections/, and raw/ directories) could be used by an adversary to embed malicious instructions that the agent might inadvertently follow during its compile or query operations.
Ingestion points: Files in meetings/, customer-language/, sales-objections/, and raw/ are populated from external integrations.
Boundary markers: No explicit sanitization or robust boundary markers (e.g., XML tags with nonces or specific escaping) for ingested content are defined in the instructions.
Capability inventory: The skill performs file read/write operations, executes pandoc via shell commands, and conducts network research via deep-research.
Sanitization: Sanitization of external content before interpolation into prompts or document generation is not specified.
[COMMAND_EXECUTION]: The skill utilizes shell commands for document rendering, specifically invoking pandoc to convert markdown outputs into PDF format within the outputs/ directory. The command structure described in references/schema.md uses shell interpolation for file paths and metadata titles. If these values are derived from unvalidated content (such as a user-provided question that is converted into a question-slug), it creates a potential surface for command injection.
[EXTERNAL_DOWNLOADS]: The skill references automated synchronization with various external services including Fathom, Gong, Slack, and multiple CRM providers (HubSpot, Attio, Pipedrive). While these are well-known services, the automated fetching of remote data into the agent's execution context increases the overall attack surface and facilitates the ingestion of untrusted data described in the indirect prompt injection finding.

company-brain