The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple sources (session databases, cron logs, memory files) and aggregates them into a summary. This data could contain malicious instructions intended to influence the agent when it eventually processes the generated digest.
Ingestion points: The scripts/summarize.py script reads data from paths provided via --sessions-db, --cron-dir, --memory-dir, --log-file, and --decisions-dir arguments.
Boundary markers: The script wraps summary items in double quotes in the Markdown output (e.g., in render_markdown), but does not include explicit warnings to the agent to ignore embedded instructions within the processed text.
Capability inventory: The skill has local file system read/write access and SQLite read access. It does not possess network capabilities, subprocess execution, or dynamic code evaluation features.
Sanitization: The truncate function in scripts/summarize.py cleans whitespace and limits string length, but does not filter for prompt injection patterns or escape Markdown syntax.
[DATA_EXPOSURE]: The skill is designed to collect and summarize sensitive information, including session topics, memory updates, and tool usage logs.
Evidence: scripts/summarize.py implements logic to query SQLite session databases and read directory contents for memory facts and cron results.
Context: While the tool itself does not exfiltrate this data (it only writes to local files or stdout), the documentation suggests piping this output to messaging platforms, which could lead to accidental exposure of secrets if the source data is not carefully managed.

scheduled-summary