The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructions (in examples/3p-updates.md, examples/company-newsletter.md, and examples/faq-answers.md) explicitly direct the agent to access sensitive internal data sources including Slack messages, company emails, Google Drive documents, and Calendar events. While these are intended for drafting internal updates, a malicious actor could theoretically craft content within these tools to influence the agent's output.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it processes untrusted data from multiple external sources (Slack, Email, Drive) to generate its output. There is a risk that malicious instructions embedded in a Slack message or document could be interpreted by the agent during the synthesis of a newsletter or FAQ.
Ingestion points: Reads from Slack channels, corporate emails, Google Drive documents, and Calendar event attachments.
Boundary markers: The instructions do not specify strict delimiters (like XML tags or clear boundaries) when interpolating data from these sources, although they do provide strict output formatting guidelines.
Capability inventory: The skill uses tools to read communications and documents. It does not appear to have direct file-write or network-send capabilities beyond responding to the user request.
Sanitization: There are no explicit instructions to sanitize or filter out instructions found within the accessed data sources.

internal-comms