The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests conversation thread data (subjects, metadata) from the HubSpot API, which can contain content from untrusted external sources (email senders or chat participants).
Ingestion points: Data is fetched using hubspot conversations threads list and stored in /tmp/threads.jsonl as described in SKILL.md.
Boundary markers: None; the instructions do not include specific delimiters to protect the agent from processing malicious content embedded in thread data as instructions.
Capability inventory: The skill includes commands to modify thread assignments and archive threads, creating a path for automated actions based on untrusted input.
Sanitization: There is no evidence of content sanitization or validation of the data retrieved from the API before it is processed or summarized.
[COMMAND_EXECUTION]: The provided bash scripts (e.g., assign_threads and archive_threads in SKILL.md) interpolate variables extracted from API JSON output directly into shell command strings. This pattern relies on the integrity of the data returned by the HubSpot service to prevent command injection.
[DATA_EXFILTRATION]: The skill exposes conversation metadata locally by writing JSONL data—including thread IDs, statuses, and timestamps—to the world-readable /tmp directory (e.g., /tmp/inboxes.jsonl, /tmp/threads.jsonl). In multi-user or shared environments, this constitutes a risk of information disclosure.

conversation-inbox-triage