The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes attribution outputs from an external weekly pipeline and appends them to a shared context file (shared-context/audience-notes.md) which is intended for use by downstream agents. This creates a potential chain where malicious or malformed data in the pipeline could influence the behavior of other agents via the shared storage.
Ingestion points: The skill reads "attribution outputs" and "observations" from the weekly reporting pipeline (SKILL.md).
Boundary markers: Observations are formatted into structured YAML blocks using specific fields (date, week, observation, confidence, etc.). However, there are no explicit boundary markers or instructions provided to the agent to sanitize or escape potentially malicious natural language instructions embedded within the processed observations.
Capability inventory: The skill performs file-system append operations (SKILL.md) to modify a shared context file. It does not possess network or shell execution capabilities.
Sanitization: The skill implements quality filters (confidence ≥ medium) and a deduplication mechanism based on the content of the observation field. It also enforces a privacy guardrail to prevent individual subscriber information from being recorded, though it lacks specific sanitization for prompt injection strings.

update-audience-notes