The Agent Skills Directory

[PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection due to its core functionality of ingesting and processing untrusted data from external sources.
Ingestion points: The workflow explicitly encourages pulling context from external messaging platforms (Slack, Teams) and document repositories (Google Drive, SharePoint, SharePoint) via integrations and connectors in SKILL.md.
Boundary markers: There are no explicit instructions or delimiters defined to separate the ingested context from the agent's internal instructions, nor are there warnings to ignore potentially malicious commands within that data.
Capability inventory: The skill utilizes create_file and str_replace to write and modify content in the local environment and invokes sub-agents to process the generated documents.
Sanitization: No specific sanitization, validation, or filtering of the external data is performed before it is used to draft the document sections.
Mitigation: The risk is mitigated by the highly structured "Human-in-the-loop" design, requiring user curation and iterative approval at every step, as well as a dedicated "Reader Testing" phase that analyzes the output for inconsistencies and ambiguity.

doc-coauthoring