The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection because it routinely ingests untrusted data from multiple external sources, including Slack messages, Gmail emails, GitHub PR comments, and Jira tickets (SKILL.md Stage 2). While the skill includes instructions for subagents to identify and flag adversarial content in tool outputs (references/subagent-contract.md), it lacks formal sanitization or escaping for HTML/JS when this data is interpolated into the generated workspace files.
Ingestion points: Data is pulled via Slack, Gmail, Google Calendar, GitHub, and Jira MCP tools (SKILL.md Stage 2).
Boundary markers: There are no explicit structural delimiters used to isolate ingested data from the prompt or output template.
Capability inventory: The skill has extensive capabilities including shell execution (Bash), local file system access (Read/Write), and browser automation (Playwright).
Sanitization: The skill implements specific escaping for '#' characters to prevent SilverBullet parsing issues, but does not perform general escaping of HTML or Javascript from ingested messages.
[DYNAMIC_EXECUTION]: To provide an interactive experience in the SilverBullet environment, the skill generates HTML components with complex embedded Javascript in onclick handlers, specifically for task checkboxes and a standup copy button (references/checkbox-span-handler.md, references/standup-copy-block.md). Additionally, the skill uses browser_evaluate to execute Javascript in a browser context for the purpose of DOM layout verification (SKILL.md Stage 5).
[DATA_EXFILTRATION]: By design, the skill aggregates sensitive company and personal data (emails, chats, calendar events, PR details) into a local repository ($SITREP_REPO). This repository is then automatically committed and pushed to a remote Git server (SKILL.md Stage 6 and Stage 8), which constitutes a data exfiltration pattern, although it is the primary intended purpose of the skill.
[COMMAND_EXECUTION]: The skill makes extensive use of local shell commands via a restricted Bash tool to perform environment setup, configuration parsing, and repository management (e.g., git add/commit/push, docker compose, gh CLI). These commands are integral to its workflow automation.

wk-sitrep