The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process inbound email replies, which constitutes untrusted external data. This is an inherent surface for indirect prompt injection attacks. However, the instructions explicitly require the use of safety guardrails, such as 'tripwires' and 'residue tests', which are designed to detect and mitigate malicious patterns in the inbound data before a decision is reached.
Ingestion points: SKILL.md (Step 2: refresh-backlog attaches new inbound mail).
Boundary markers: The instructions specify that the full inbound path applies, including tripwires and residue tests.
Capability inventory: Uses db.mjs for session management and playbook.mjs for tracking dossier applications.
Sanitization: The skill delegates reasoning and safety checks to the act-or-decide process, which includes classification and guardrail verification.
[COMMAND_EXECUTION]: The skill invokes local JavaScript files (db.mjs and playbook.mjs) to perform database operations and list dossier information. These scripts appear to be vendor-provided tools for state management within the agent's workspace.

process-reply