The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and query untrusted external data, which creates a surface for indirect prompt injection attacks.
Ingestion points: Untrusted data enters the system through meeting transcripts (Fathom/Gong), Slack exports, emails, and CRM data stored in the meetings/, people/, and companies/ directories.
Boundary markers: The instructions do not define specific delimiters or "ignore previous instructions" warnings to wrap the ingested content when it is provided to the agent as context.
Capability inventory: The skill possesses the capability to read and write to the local file system and execute shell commands like git and pandoc.
Sanitization: There is no explicit mention of sanitizing or escaping the external content before it is interpolated into the agent's prompt during the query or compile modes.
[COMMAND_EXECUTION]: The skill utilizes standard command-line tools for vault initialization and document generation.
Evidence: The skill documentation in references/vault-config.md and references/schema.md provides instructions for using git, mkdir, and pandoc to manage the knowledge base and export markdown files to PDF format.
[EXTERNAL_DOWNLOADS]: The skill describes integration patterns with various third-party platforms to synchronize data.
Evidence: references/auto-sync-sources.md lists several well-known services such as Slack, HubSpot, Zendesk, and Gong as potential sources for automated data capture into the knowledge base.
[DATA_EXFILTRATION]: While not directly exfiltrating data, the skill is designed to manage and query highly sensitive company information.
Evidence: The system handles PII (contacts), internal decision records, meeting transcripts, and sales strategies. It attempts to mitigate risk through a manual sensitivity tagging system (internal, leadership, confidential) and human review processes.

company-brain