The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface by design, as it systematically ingests untrusted data from external sources and processes it using sensitive tools and sub-agents.
Ingestion points: The workflow explicitly prompts for data from messaging channels (Slack, Teams), document repositories (Google Drive, SharePoint, shared links), and manual user "info dumps" (SKILL.md).
Boundary markers: The instructions do not mandate the use of delimiters or provide directives to the agent to disregard instructions embedded within the gathered context when reading from external sources.
Capability inventory: The agent has access to file system operations (create_file, str_replace) and the ability to invoke sub-agents for "Reader Testing" (SKILL.md).
Sanitization: There are no instructions for sanitizing, escaping, or validating the external content before it is interpolated into the prompt or passed to sub-agents.
[EXTERNAL_DOWNLOADS]: The skill utilizes platform integrations and MCP servers to retrieve content from third-party messaging and storage services.
Evidence: It instructs the agent to use available integrations (e.g., Slack, Teams, Google Drive, SharePoint) to "pull in context directly" or "fetch" shared documents based on user-provided links (SKILL.md).

doc-coauthoring