The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted data from external sources and possesses capabilities that could be abused if the agent follows instructions embedded in that data.
Ingestion points: The skill processes incoming email requests (gws-gmail) and reads onboarding documents (gws-drive) as part of its primary workflow in SKILL.md.
Boundary markers: There are no defined delimiters or instructions provided to the agent to distinguish between its system-level instructions and data received from external files or emails.
Capability inventory: The skill utilizes tools to send emails (gws gmail +send), upload files to Drive (gws drive +upload), announce content in Chat (gws workflow +file-announce), and create calendar events (gws calendar +insert), providing a significant surface for data exfiltration or unauthorized actions if an injection occurs.
Sanitization: While the instructions suggest using a --sanitize flag for PII, there is no evidence of sanitization or escaping mechanisms for the text content to prevent the execution of embedded prompts.

persona-hr-coordinator