The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external sources, which could contain malicious instructions meant to influence the email drafting process.
Ingestion points: Reads external social media threads and company homepages through the recoup-internal-consulting-lead-context capability.
Boundary markers: The instructions lack explicit boundary markers or warnings to the agent to ignore instructions embedded in the external content.
Capability inventory: The skill has the capability to stage outbound emails and spawn subagents for review, creating a vector where injected instructions could reach a recipient.
Sanitization: There is no mention of sanitizing, filtering, or validating the content retrieved from external URLs before processing.
[DATA_EXFILTRATION]: The skill requires access to extensive sensitive internal data to perform its task. While this is the intended workflow for the vendor's staff, the breadth of access is significant.
Evidence: The skill accesses Gmail history (including that of colleagues), Granola meeting notes, Attio CRM records, and internal deal files within the pipeline/ and clients/ directories.

recoup-internal-consulting-outbound-email