The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill establishes an ingestion point for external data via the msg inbox command, making the agent susceptible to instructions embedded in messages from other sessions.
Ingestion points: The msg inbox command described in SKILL.md reads messages from other agents into the current session context.
Boundary markers: There are no instructions for the agent to use delimiters or to treat incoming message content as purely passive data, which could lead the agent to execute instructions found in messages.
Capability inventory: The agent has shell access to execute the msg CLI and potentially other system tools, providing a vector for injected commands to take action.
Sanitization: The documentation does not specify any sanitization, filtering, or validation processes for the content of received messages.
[DATA_EXFILTRATION]: The msg send and msg reply commands facilitate the movement of information between different agent sessions. While intended for coordination, this mechanism could be misused to exfiltrate sensitive data, such as environment variables or private file contents, by sending them to an external or attacker-controlled agent session.

msg