The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves gathering context from untrusted external sources, making it susceptible to malicious instructions embedded in that data.
Ingestion points: Stage 1 (Context Gathering) and Stage 3 (Reader Testing) instructions direct the agent to fetch content from user-provided links, uploaded files, and messaging channels (Slack, Teams) or document platforms (Google Drive, SharePoint) via integrations.
Boundary markers: The skill lacks instructions to use delimiters or specific ignore-rules for content ingested from these external sources.
Capability inventory: The agent is instructed to use create_file to write to the local filesystem, str_replace to modify files, and various MCP integrations for network and platform access.
Sanitization: There is no mention of filtering, escaping, or validating the input gathered from external platforms before the agent processes it.
[COMMAND_EXECUTION]: The skill provides procedural instructions for the agent to modify the local environment using standard filesystem tools.
Evidence: Stage 2 (Refinement & Structure) explicitly instructs the agent to use create_file to establish document scaffolds and str_replace to apply surgical edits to the resulting files.
[METADATA_POISONING]: The skill's frontmatter includes a risk: critical field.
Evidence: The YAML frontmatter contains risk: critical, which is inconsistent with the skill's functional purpose and standard security tagging. This field represents non-authoritative metadata that contradicts the analyzed behavior of the skill body.

doc-coauthoring