The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill includes a command in SKILL.md to fetch service status from https://status.granola.ai/api/v2/status.json. Although this data is piped to python3, the script being executed is a hardcoded, static block provided within the skill's instructions rather than a script downloaded from the remote server. The script safely parses the JSON output to display the service status.
[INDIRECT_PROMPT_INJECTION]: The skill describes a data pipeline that ingests untrusted meeting metadata (titles, attendees, and meeting notes). This represents a potential surface for indirect prompt injection if the agent were to process these records later. However, the logic is limited to extraction of metadata (e.g., counting action items, checking for external attendees) and does not involve executing the meeting content as instructions.
[COMMAND_EXECUTION]: The skill utilizes Bash tools (curl and python3) for operational monitoring. These tools are used for their intended purpose of checking API status and processing the resulting data, which aligns with the skill's primary function as an observability tool.

granola-observability