The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection because it is designed to ingest and process content from external sources such as Slack messages and Notion documents.
Ingestion points: The skill uses Notion:notion-fetch and Slack:slack_read_thread to retrieve content from external pages and message threads into the agent's context.
Boundary markers: There are no specific instructions to use delimiters or ignore embedded instructions within the retrieved data, although the skill emphasizes verbatim quoting and citation which provides some context separation.
Capability inventory: The skill's capabilities are limited to reading from Notion and Slack; it lacks high-risk capabilities such as file system writes, arbitrary network requests, or shell command execution.
Sanitization: The instructions do not define any sanitization or filtering protocols for the data retrieved from external platforms.

formsg-oracle