The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted financial data from external bank and invoicing connectors, creating a potential surface for indirect prompt injection attacks.
Ingestion points: The skill ingests transaction histories, invoice metadata, and account balances using tools such as well_sum_transactions, well_sum_invoices, and well_list_account_balances as detailed in references/pages.md and references/policies.md.
Boundary markers: There are no explicit instructions for the agent to treat external data as untrusted or to ignore instructions that might be embedded in natural language fields like transaction descriptions or invoice notes.
Capability inventory: The skill's active capabilities are primarily read-only. Tools that modify data, such as well_assign_account and well_set_transaction_category, are strictly gated by user confirmation via specific card UI elements, preventing the agent from executing writes autonomously.
Sanitization: The instructions do not define any specific sanitization or filtering procedures for external content before it is processed by the model.

board-pack