The Agent Skills Directory

[PROMPT_INJECTION]: The skill inherently possesses an indirect prompt injection surface because it reads and processes data from the ChatGPT web interface using mcp__Claude_in_Chrome__get_page_text and mcp__Claude_in_Chrome__read_page. While the instructions include robust guardrails to prevent the agent from following embedded instructions (e.g., instructions for the 'Watcher' subagent to flag clarification questions and OAuth prompts for human review), the ingestion of untrusted external content remains a factor.
Ingestion points: Web content from ChatGPT is read via mcp__Claude_in_Chrome__get_page_text and mcp__Claude_in_Chrome__read_page in SKILL.md and references/watcher-subagent.md.
Boundary markers: There are no explicit technical boundary markers for the data, but the skill uses a structured subagent model with specific instructions to detect and isolate interactive or suspicious content.
Capability inventory: The skill uses Bash (for file management), Write (for saving chat logs), and claude-in-chrome (for browser-based interactions).
Sanitization: Filenames are sanitized using a specific substitution logic (title-sanitized) described in references/save-conversation.md, though no explicit sanitization of the ChatGPT response text itself is mentioned before it is processed by the LLM.
[COMMAND_EXECUTION]: Uses a local shell script (scripts/heartbeat.sh) and standard commands (ls, mv, mkdir) to manage task monitoring and organize downloaded artifacts within the user's ~/Downloads directory. All operations are limited to local file system management with instructions for the agent to handle filenames safely.
[EXTERNAL_DOWNLOADS]: Facilitates the download of files, images, and reports from ChatGPT (chatgpt.com). These operations are initiated via browser-native download mechanisms and are subject to explicit user confirmation instructions provided within the skill guidelines.

claude-chatgpt-skill