The Agent Skills Directory

[PROMPT_INJECTION]: The skill exposes an attack surface for indirect prompt injection by ingesting and processing untrusted data from multiple external channels (Gmail, Calendar, Linear, Slack, GitHub, and Drive) to create stored 'Facts'.
Ingestion points: Untrusted data enters the context from various third-party tool integrations mentioned in SKILL.md.
Boundary markers: There are no explicit boundary markers or instructions to ignore embedded commands within the ingested data, increasing the risk that the AI might adopt instructions found in emails or documents as its own.
Capability inventory: The skill possesses write capabilities to both a personal knowledge store (via the memory tool) and a Neon database (via db.mjs).
Sanitization: The skill includes logic to detect 'degenerate' facts (token loops) but acknowledges that the storage backend frequently strips attribution and hedging, which could result in the agent treating untrusted or inferred information as confirmed ground truth.
[COMMAND_EXECUTION]: The skill executes local shell commands to facilitate its operational logic and dependency management.
Evidence: It runs bash "${CLAUDE_PLUGIN_ROOT}/shared/ensure-deps.sh" for environment setup and uses node "${CLAUDE_PLUGIN_ROOT}/shared/db.mjs" to manage database cursors and the 'crawl frontier' queue.

update-brain