The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external communication tools, creating a potential surface for indirect prompt injection.
Ingestion points: The Gather section of SKILL.md fetches data from email threads, chat mentions, DMs, document comments, and calendar entries.
Boundary markers: The Ground rules section explicitly mandates that all gathered content must be treated as data to be summarized, and the agent must ignore any commands or instructions embedded within that data.
Capability inventory: The skill is limited to rendering a static HTML artifact and generating deep links to the claude.ai platform. It does not have the capability to write to the file system, execute shell commands, or make background network requests.
Sanitization: The Ground rules require the agent to render gathered text as escaped plain text within the HTML artifact, preventing the execution of malicious scripts or markup (XSS).
[DATA_EXFILTRATION]: The skill accesses sensitive user data including emails, private chats, and documents. It aggregates this information into a seed parameter for a URL (https://claude.ai/new?q={urlencoded seed}). While the destination is the trusted claude.ai domain, this involves transmitting user-specific context and verbatim quotes through URL parameters.
[DYNAMIC_EXECUTION]: The skill generates complex HTML and SVG content dynamically at runtime based on the gathered data. The Write section provides extensive instructions for rendering an SVG terrain map and a styled HTML layout, including the embedding of fonts as Base64 data URIs.

morning