The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple sources, including external emails via agentmail/himalaya, client notes via obsidian, and web search results.
Ingestion points: Sensitive data enters the context through CRM lookups, email summaries (Step 4), and web searches (Step 3).
Boundary markers: The instructions lack delimiters (e.g., XML tags or triple quotes) or explicit directives telling the agent to ignore any commands embedded within the emails or notes being summarized.
Capability inventory: The agent has access to sensitive CRM databases, email systems, and web search tools.
Sanitization: No sanitization or filtering logic is specified for the external content before it is processed by the LLM, creating a surface for adversarial content in an email to influence the agent's behavior.
[DATA_EXFILTRATION]: The skill is designed to access and aggregate highly sensitive PII (Personally Identifiable Information) and financial data (AUM, risk profiles, holdings, and transaction history).
Exposure surface: While the skill includes a safety warning against forwarding data to clients, it utilizes web_search to find news related to specific holdings. If search queries are generated using sensitive identifiers, there is a risk of technical data exposure to the search provider.
Access control: The skill requires broad permissions across multiple platforms (Airtable, Notion, Google Workspace, Email), increasing the impact if the agent is compromised via indirect injection.

meeting-prep-agent