The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from various sources, creating a risk of indirect prompt injection. \n
Ingestion points: The agent reads external data via emails, search (full bodies), thread (full bodies), attachment (content), and meeting (transcripts) as defined in SKILL.md. \n
Boundary markers: Absent. The instructions do not specify any delimiters or warnings to ignore embedded instructions in the processed data. \n
Capability inventory: The skill possesses extensive write capabilities, including spark draft and spark action send for sending emails, spark event for managing calendar invites, and spark contact-action for blocking/accepting contacts, all documented in SKILL.md. \n
Sanitization: Absent. There is no mention of sanitizing or escaping the retrieved content before it is processed by the agent. \n- [COMMAND_EXECUTION]: The skill requires the execution of the spark CLI binary to interact with the user's Spark Desktop app. \n- [DYNAMIC_EXECUTION]: The skill contains instructions for the agent to update its own logic by overwriting its SKILL.md file using the output of a shell command (spark skill > ...). This self-modification mechanism allows the skill's instructions to be altered at runtime, which could be exploited if the output of the CLI tool is compromised.

use-spark