The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect prompt injection by ingesting untrusted data from various external sources to assist in document creation.
Ingestion points: The workflow involves fetching content from linked shared documents, reading uploaded files, and pulling messages from team channels (e.g., Slack, Teams, Google Drive) via integrations.
Boundary markers: The instructions lack explicit delimiters or guidance to treat external content strictly as data, which may allow embedded instructions to influence the agent's behavior.
Capability inventory: The skill utilizes create_file and str_replace to generate and modify document artifacts. Furthermore, it employs a 'Reader Testing' phase where it spawns sub-agents to analyze the generated content, potentially propagating malicious instructions through a multi-step chain.
Sanitization: There is no mention of sanitizing, escaping, or filtering the ingested external data before it is interpolated into prompts for the primary agent or sub-agents.

doc-coauthoring