The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources, creating a surface for indirect prompt injection attacks.
Ingestion Points: In Phase 1.8, the skill performs a WebSearch for K-12 financial news and uses WebFetch to extract content from the top articles. In Phase 1.7, it uses WebFetch to scrape content from various legislative bill URLs.
Boundary Markers: There are no specific instructions to use delimiters (e.g., XML tags or backticks) or 'ignore embedded instructions' warnings when interpolating this external content into the briefing markdown or the podcast script.
Capability Inventory: The agent possesses Bash capabilities, which are used to send emails, generate audio, and execute local scripts, providing a direct path for an injection to trigger unintended actions.
Sanitization: The instructions do not define any sanitization, escaping, or filtering for the fetched synopses before they are processed by the LLM.
[COMMAND_EXECUTION]: The skill relies on the execution of multiple local scripts via bun and uv run located at absolute paths in a specific user directory (/Users/hagelk/non-ic-code/geoffrey/skills/). These scripts interact with internal district services like Red Rover and FreshService. While these appear to be legitimate tools for the author's environment, this level of system interaction requires high trust in the integrity of those local scripts.

cfo-briefing