The Agent Skills Directory

**[Indirect Prompt Injection
User Input]:** The skill takes user inputs such as meeting_identifier and date and interpolates them directly into a natural language query sent to the workiq-ask tool. Because these inputs are not sanitized, a maliciously crafted identifier could potentially contain instructions that override the tool's intended logic.
**[Indirect Prompt Injection
External Content]:** The skill fetches and parses Teams meeting chat messages which are authored by meeting participants. This untrusted content could contain instructions designed to manipulate the extraction of action items or influence downstream processes that use the resulting structured data.
Ingestion points: The skill ingests user-provided meeting_identifier and date parameters, as well as meeting chat transcript data fetched in Step 2.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the prompt templates used for workiq-ask or in the parsing logic.
Capability inventory: The skill utilizes the workiq-ask tool to read user profiles, meeting details, and chat messages. It does not appear to have file-write or network-out capabilities based on the provided instructions.
Sanitization: There is no evidence of input validation, escaping, or filtering for the external meeting content before it is parsed for action-oriented language.
[Data Access Context]: The skill retrieves sensitive information including user profiles, attendee names, and email addresses. While necessary for cross-referencing owners, this access pattern reinforces the need for the skill to operate within a trusted environment with appropriate permissions.

action-item-extractor