The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external meeting transcripts and notes, which could be used to influence agent behavior.
Ingestion points: Meeting transcripts and notes are ingested via granola-pp-cli sync, sync-api, and transcript get as described in SKILL.md.
Boundary markers: The instructions do not define delimiters or specific system prompts to ignore instructions that might be embedded within the meeting content.
Capability inventory: The skill uses Read Bash to execute CLI commands, supports writing output to arbitrary file paths via --deliver file:<path>, and can POST data to remote URLs using --deliver webhook:<url>.
Sanitization: No sanitization or escaping of the ingested meeting data is mentioned before the agent processes it.
[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the granola-pp-cli tool from external registries.
Fetches the @mvanhorn/printing-press-library package from the NPM registry via npx.
Downloads and installs source code from github.com/mvanhorn/printing-press-library using go install.
[COMMAND_EXECUTION]: The skill's core functionality involves executing shell commands to interact with the granola-pp-cli binary, including managing meetings, extracting transcripts, and querying a local SQLite database.
[DATA_EXFILTRATION]: The CLI tool includes a built-in feature to route output to external URLs (--deliver webhook:<url>). While this is a documented feature, it could be misused by an agent influenced by a prompt injection to exfiltrate sensitive meeting data to an attacker-controlled endpoint.

pp-granola