The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by processing untrusted data from various sources (Slack, Email, Google Drive, Calendar) to generate communications. A malicious message or document could contain hidden instructions that cause the agent to exfiltrate data or provide misleading information in company-wide newsletters or FAQ responses.
Ingestion points: examples/3p-updates.md, examples/company-newsletter.md, and examples/faq-answers.md all instruct the agent to ingest data from Slack messages, Emails, Google Drive documents, and Calendar events.
Boundary markers: The skill lacks explicit boundary markers or instructions to ignore embedded commands within the ingested text, increasing the risk of the model following instructions found in the data.
Capability inventory: The skill uses tools to read sensitive communication history and file contents. While it primarily writes output back to the user/session, the potential to influence company-wide communications is a significant capability.
Sanitization: There is no evidence of sanitization or filtering of the content pulled from external sources before it is processed by the LLM.

internal-comms