The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted message content from external contacts which may contain malicious instructions designed to manipulate the agent's drafting behavior.
Ingestion points: Data enters the context through the read_conversation and get_contact tools which fetch content from external messaging platforms.
Boundary markers: The instructions do not define specific delimiters or 'ignore' instructions to isolate the untrusted message content from the system prompt.
Capability inventory: The skill includes the ability to send messages via the send_dm tool and manage threads with the approve_reply tool.
Sanitization: There is no mention of sanitization or filtering logic for the retrieved message content.
[DATA_EXFILTRATION]: The skill reads sensitive user configuration from a local file to determine the 'voice' for drafts.
Evidence: The instruction to 'Read ~/.uplika//voice.md first if it exists.'
Context: This file access is restricted to a vendor-specific hidden directory and is essential for the skill's primary function of drafting personalized replies.

inbox