The Agent Skills Directory

[Indirect Prompt Injection]: The skill processes untrusted content from external emails and chat messages. To mitigate the risk of embedded malicious instructions, the skill defines clear boundaries and instructs the agent to treat all ingested text as data rather than commands. * Ingestion points: The skill reads from workiq_list_emails, workiq_list_chats, and workiq_list_chat_messages as described in SKILL.md. * Boundary markers: The skill explicitly instructs the agent in SKILL.md and references/signal-rules.md to surface suspicious items in a 'Worth a look' section rather than obeying them. * Capability inventory: The skill uses workiq_send_email and Teams chat posting to deliver the brief, as well as file access to ~/.copilot/work-brief/ for configuration and state management. * Sanitization: The instructions mandate summarizing rather than quoting sensitive content and specifically ignore instructions found within communication bodies.
[Persistence]: The skill includes functionality to set up recurring automations. While this allows the skill to run periodically at scheduled times, it is a documented feature requiring explicit user setup and configuration stored in the user's home directory (~/.copilot/work-brief/).
[Data Handling and Communication]: The skill aggregates sensitive workplace information from Outlook and Teams. It is configured to deliver this information exclusively to the user's own communication channels (self-chat or personal work email), and it explicitly forbids @mentioning others or responding to external threads to prevent unintended data sharing.
[Dynamic Tool Discovery]: The skill instructs the agent to dynamically identify and bind to platform-specific tools for calendar access and Teams messaging. While this involves runtime identification of capabilities, it is performed within the constraints of the host environment's provided toolset.

work-brief