The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes activity data from several untrusted external sources, including GitHub PR titles, commit messages, Slack conversations, and Google Calendar events. If these sources contain malicious prompts, they could attempt to influence the agent's behavior during the summarization or report-writing phases.\n
Ingestion points: Data is retrieved via gh api (GitHub), slack_search_public_and_private (Slack), gws calendar events list (Google Calendar), and {claude_history_path} (local conversation history).\n
Boundary markers: The instructions do not specify the use of delimiters or specific warnings to ignore instructions embedded within the gathered data.\n
Capability inventory: The skill uses Bash to execute system tools, Read to access history files, and Write to save the final report to the local filesystem.\n
Sanitization: The agent is instructed to summarize and filter content, which provides some normalization but does not constitute formal sanitization against injection attacks.\n- [COMMAND_EXECUTION]: The skill requires the execution of a local Python script (scripts/skillctx-resolve.py) during setup to manage configuration and resolve variable bindings. It also executes various CLI tools (gh, gws) via shell commands to retrieve user activity data.\n- [DATA_EXFILTRATION]: The skill accesses a broad range of sensitive data across multiple platforms, including private messaging, calendar events, and local shell history. While the data is intended for local report generation, the scope of visibility into personal activity constitutes a potential exposure risk.\n- [PROMPT_INJECTION]: The skill includes instructions to conceal specific implementation details (e.g., 'Claude', 'history.jsonl') from the final report. Although this is for professional formatting, the use of concealment rules is a pattern that can be used to hide tool execution details from the user.

p-daily-report