The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves processing large amounts of untrusted data from various external platforms, including press outlets, community forums (Hacker News, Reddit), and social media. This ingestion surface is vulnerable to indirect prompt injection attacks where malicious actors could embed instructions in web content to manipulate the agent's triage logic or influence its reporting.
Ingestion points: Content retrieved from public search results and full-page extractions of signals across tiers defined in references/sources.md.
Boundary markers: The instructions do not specify the use of robust delimiters or explicit instructions to treat the ingested data as untrusted, which increases the risk of the model following instructions embedded in the search results.
Capability inventory: The skill has the capability to write to the local workspace for state persistence and can flag items to user-defined communication channels.
Sanitization: There is no mention of sanitizing external data to remove potentially malicious markdown or code patterns before the agent processes it.
[PERSISTENCE]: The skill maintains state across sessions by writing fingerprints of signals and tracking unresolved items in a workspace file (launch-monitor-[YYYY-MM-DD].md). This persistence is used for deduplication and continuity but involves recurring file write operations.
[DATA_EXFILTRATION]: The skill provides placeholders for communication channels ({{ALERTS_CHANNEL}}, {{COMMS_OWNER}}) to route launch alerts. While these endpoints are configured by the user, they represent potential egress points. The skill mitigates this risk by explicitly stating that all suggested responses and corrections are drafts and MUST NOT be sent without human approval.

launch-monitor