The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is designed to ingest and process data from external, untrusted sources such as shared documents, team messaging channels, and user-provided links without proper isolation.
Ingestion points: Data enters the context through user info dumps, shared document links, and team channel threads as described in SKILL.md (Stage 1: Context Gathering).
Boundary markers: The skill does not provide instructions to use delimiters or explicit 'ignore embedded instructions' warnings when the agent reads external content.
Capability inventory: The agent possesses capabilities to create files (create_file), edit files (str_replace), and invoke sub-agents to process the ingested content.
Sanitization: There is no evidence of escaping, validation, or filtering of content retrieved from external integrations or user-provided links.
[DATA_EXPOSURE]: The workflow encourages the disclosure of sensitive internal information by explicitly asking the user for context regarding 'team dynamics, past incidents, politics' and requesting access to private team channels and shared documents. While this is functional for the skill's purpose, it increases the risk of sensitive data exposure to the model context.

doc-coauthoring