The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple external sources (Slack, Email, Notion, Dashboards) to generate user briefings. It lacks explicit boundary markers or sanitization, creating an attack surface for indirect prompt injection where malicious instructions embedded in an email or Slack message could influence the agent's behavior. 1. Ingestion points: references/slack-integration.md, references/email-integration.md, and references/notion-integration.md. 2. Boundary markers: Absent; there are no instructions to use delimiters or ignore instructions within source data. 3. Capability inventory: High-trust MCP access to read and draft responses in Slack, Gmail, and Notion. 4. Sanitization: Absent; the skill extracts text directly for synthesis.
[COMMAND_EXECUTION]: Extensively utilizes MCP connectors to perform operations across Slack, Gmail, and Notion. While these are legitimate integrations for the skill's purpose, they expose high-privilege capabilities that could be abused if the agent's context is poisoned by malicious external data.
[DYNAMIC_EXECUTION]: Security-positive: references/dashboard-parsing.md contains strict instructions to strip formulas and explicitly forbids the execution of VBA macros in Excel or Tableau files, mitigating potential macro-based remote code execution.
[PERSISTENCE]: Security-positive: references/mcp-connector-setup.md explicitly prohibits writing user tool-stack configurations to local files, ensuring the environment remains ephemeral and reducing the risk of stale or unauthorized configuration persistence.

executive-morning-briefing