The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes content from several untrusted external sources, including emails, CRM leads, and messenger communications. If an attacker controls one of these sources (e.g., by sending an email or submitting a lead form), they could include instructions designed to hijack the agent's behavior.
Ingestion points: Data is pulled from ~~бухгалтерия (accounting), ~~crm, ~~календарь (calendar), ~~почта (email), and ~~мессенджер (messenger) as described in Step 1 of SKILL.md.
Boundary markers: The skill instructions do not specify any delimiters or safety warnings to help the agent distinguish between its instructions and the data being processed.
Capability inventory: The skill is granted access to the Bash tool (allowing shell command execution), Read (file system access), and WebFetch (network operations).
Sanitization: There is no evidence of input validation, escaping, or sanitization for the data retrieved from external connectors before it is processed or included in the final brief.
[DATA_EXFILTRATION]: The skill is designed to aggregate highly sensitive data, including financial balances, cash flow, sales trends, and customer deal status. This data is then transmitted to external cloud storage providers (Yandex Disk or Cloud Mail.ru) and messaging platforms (Telegram or VK Teams). While this is the intended purpose of the skill, it represents a significant data movement pattern involving sensitive business intelligence.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to interact with the file system, specifically for saving generated markdown reports to the local desktop (~/Desktop/) and abstracted cloud storage mounts (~~хранилище).

monday-brief