The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it is designed to ingest and parse untrusted data from external chat platforms (Slack, Discord, WhatsApp, etc.) or shared documents.
Ingestion points: The collection workflow in SKILL.md and README.md instructs the agent to read raw chat logs, exports, or pasted text provided by the user.
Boundary markers: SKILL.md contains clear boundary instructions, directing the agent to store only structured items and short excerpts for provenance rather than full logs, and to use the minimum required data.
Capability inventory: The skill uses scripts/ingest_updates.mjs to validate and write structured data into Busabase and scripts/execute_decisions.mjs to read approved reminders and write execution plans back to the database. Outbound reminders are sent via separate skills (kelly-messenger, kelly-email).
Sanitization: The agent is instructed to parse untrusted content into a strict schema before merging. The ingestion script (scripts/ingest_updates.mjs) provides a deterministic validation step before any data is written to the database.
[DATA_EXPOSURE]: The skill handles sensitive team member contact information for sending reminders.
Evidence: The skill correctly avoids hardcoding or storing actual contact values (e.g., phone numbers or email addresses). Instead, it uses environment variable references (contact-env) which are only resolved by the trusted execute_decisions.mjs script. The browser-based AirApp never accesses or displays these values.

kelly-standup