The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from multiple sources, creating a surface for indirect prompt injection attacks.
Ingestion points: The skill utilizes mcp__rube__RUBE_SEARCH_TOOLS for web research and Read/Grep/Glob to examine local code and configuration files in the project workspace.
Boundary markers: There are no explicit instructions or delimiters defined to prevent the agent from following instructions embedded within the code being explained or the web results being researched.
Capability inventory: The skill has access to mcp__rube__RUBE_MULTI_EXECUTE_TOOL, which provides write capabilities to external services like Notion (NOTION_CREATE_PAGE) and Slack (SLACK_SEND_MESSAGE).
Sanitization: No sanitization or verification logic is present to filter malicious instructions from the ingested content before processing.
[DATA_EXFILTRATION]: The skill provides automated mechanisms to transmit data from the local environment to external platforms.
Evidence: The --share flag combined with mcp__rube__RUBE_MULTI_EXECUTE_TOOL allows the agent to send content to Slack and Notion. If an attacker manages to trigger an analysis of sensitive files (like .env or credentials), the resulting output could be exfiltrated through these communication channels.

sc-explain