The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from external and untrusted sources such as support tickets, HubSpot objects, Gmail messages, and Slack threads. Malicious instructions embedded in these sources could potentially influence the agent's behavior, particularly since the skill has access to file writing and shell command tools.
Ingestion points: The skill retrieves data from mcp__claude_ai_Gmail__gmail_read_message, mcp__claude_ai_Slack__slack_search_public_and_private, and HubSpot CRM search tools as defined in references/data-sources.md.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to disregard potential instructions found within the retrieved emails, tickets, or messages.
Capability inventory: The skill is authorized to use Bash, Write, Read, and Glob tools across all project files.
Sanitization: The workflow does not include steps for sanitizing or validating the content retrieved from external communication channels.
[DATA_EXFILTRATION]: The skill is configured to locate and read highly sensitive local financial and operational files using broad glob patterns. While this is the core intended purpose of the dashboard, it creates a large exposure surface for sensitive data.
Evidence: references/data-sources.md instructs the agent to glob for patterns including **/*billing*, **/*invoice*, **/*revenue*, **/*arr*, and **/*mrr*. These files often contain sensitive business information.
[COMMAND_EXECUTION]: The skill includes the Bash tool in its allowed-tools list. Although the instructions focus on data retrieval and reporting, the combination of a high-privilege shell environment with the processing of untrusted external data (emails/tickets) presents a potential path for exploitation if the agent is manipulated by an indirect prompt injection.

client-health-dashboard