The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes message content left by external entities in a shared workspace, which can contain hidden instructions that influence the agent's behavior.
Ingestion points: The check_inbox tool in handler.ts retrieves text from files located in choom_commons/for_<name>/ and provides it to the agent.
Boundary markers: There are no protective delimiters or system-level warnings that separate the untrusted message content from the agent's primary instructions.
Capability inventory: The skill allows for writing and copying files within the workspace via the leave_for_sister tool. The agent's environment likely contains additional tools for file manipulation or external communication.
Sanitization: The content of the letters and notes is returned to the agent without any filtering or escaping of potential prompt injection payloads.

sister-mail