The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from numerous external sources which are not fully trusted, creating a surface for indirect prompt injection attacks.\n
Ingestion points: The skill is designed to ingest content from GitHub (PR descriptions and review comments), Linear (issue descriptions and comments), Notion (document text), and Slack (chat messages). These sources are often editable by a variety of users, including potential external contributors.\n
Boundary markers: The prompt templates in references/investigator-prompt.md and references/synthesizer-prompt.md lack explicit delimiters or instructions for the agent to ignore potentially malicious commands embedded within the fetched data.\n
Capability inventory: The skill spawns multiple subagents with access to Model Context Protocol (MCP) tools for reading files and querying external service APIs (Notion, Slack, Sentry, etc.).\n
Sanitization: There is no evidence of sanitization or filtering performed on the content retrieved from external APIs before it is interpolated into the synthesizer's prompt.\n- [SAFE]: The skill utilizes well-known technology services and official tools for its data gathering tasks.\n
The skill references official tools like git, gh (GitHub CLI), and MCP servers for established platforms such as Datadog, Sentry, Slack, Linear, and Notion. Use of these services for the skill's primary purpose is considered safe practice.\n
No hardcoded credentials or exfiltration to untrusted third-party domains were detected.

ps-why