The Agent Skills Directory

[COMMAND_EXECUTION]: The search functionality in the vault prompt template relies on a shell command: grep -ril "<search term>" "<VM path>/". The instructions do not mandate sanitization or escaping of the <search term>, creating a risk of command injection if the search input contains shell metacharacters (e.g., semicolons, pipes, or backticks).
[DATA_EXFILTRATION]: The skill is designed to ingest and process highly sensitive information from Slack threads, Gmail messages, and Google Drive documents. While consistent with the stated purpose of a legal vault, this high-privilege access to confidential business and legal communications represents a significant data exposure risk if the agent's behavior is manipulated.
[EXTERNAL_DOWNLOADS]: The documentation encourages downloading a third-party application (Granola) and a secondary skill file (legal-guidance-vault-import.skill) from a shared folder. Installing external skill files manually can bypass centralized safety verification and platform-level security controls.
[PROMPT_INJECTION]: The skill ingests untrusted data from external communication platforms to generate summaries and legal archives, creating a surface for indirect prompt injection.
Ingestion points: Slack thread content, Gmail message bodies, Google Drive document text, and Granola meeting transcripts (via MCP and manual pasting).
Boundary markers: Absent; the prompts do not include specific instructions or delimiters to ensure the agent ignores or sanitizes potential commands embedded within the text being archived.
Capability inventory: File system access via request_cowork_directory, local file creation for vault entries, and shell command execution using the grep utility.
Sanitization: Absent; there is no mention of filtering, validating, or escaping the data retrieved from external sources before it is processed or searched.

legal-guidance-vault