The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the Plain API, which includes customer emails, chat messages, and Slack communications.
Ingestion points: Conversation history and customer details are fetched in scripts/plain-api.sh via the thread timeline and thread get actions.
Boundary markers: The skill instructions do not provide delimiters or clear warnings to the agent regarding the presence of potentially malicious instructions in the retrieved content.
Capability inventory: The skill environment has network access via curl and the ability to read local files using the cat command within a Bash tool.
Sanitization: There is no evidence of filtering or sanitization performed on the API responses before they are processed by the agent.
[COMMAND_EXECUTION]: The CLI script executes file-reading operations based on paths provided as command-line arguments.
Evidence: The thread_note function in scripts/plain-api.sh uses cat "$text_file" and the helpcenter_article_upsert function uses cat "$content_file". This creates a mechanism where an agent could be manipulated into reading sensitive local files if directed to specific system paths.

plain-support