The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes large volumes of untrusted data from multiple external sources, creating a significant attack surface for indirect instructions.
Ingestion points: Processes Slack channel messages (slack-monitor), GitHub pull request titles, descriptions, and comments (github-analyst), and meeting notes/check-ins (meeting-reviewer).
Boundary markers: The agent prompts lack explicit delimiters or specific instructions to ignore embedded commands, increasing the risk of the agent following instructions found within processed communications.
Capability inventory: The skill possesses extensive write capabilities, including Linear and Slack MCP tools for updating issues and sending messages, as well as shell access for network operations.
Sanitization: External content is interpolated directly into analysis phases without evidence of sanitization or strict schema enforcement.
[COMMAND_EXECUTION]: The skill uses local shell execution and pipelines to perform integration and publication tasks.
Evidence: Phase 3.7 and the associated templates utilize shell commands like cat and tr to retrieve authentication secrets and curl to transmit data to external APIs.
[DYNAMIC_EXECUTION]: Runtime script generation is used to format data for external transmission.
Evidence: An inline Python script (python3 -c) is generated and executed in Phase 3.7 to perform JSON encoding of the brief content before transmission to HackMD.
[DATA_EXFILTRATION]: The skill reads local sensitive files and performs authenticated network operations to a well-known service.
Evidence: The skill is instructed to read an API token from .claude/settings/hackmd-token and include it in network requests to api.hackmd.io to publish team data.

team-brief