The Agent Skills Directory

[PROMPT_INJECTION]: The skill possesses an indirect prompt injection attack surface (Category 8). It is designed to ingest and display content from external, untrusted sources which could contain malicious instructions designed to manipulate the agent.
Ingestion points: The skill reads data from numerous external platforms including Slack, Jira, GitHub, Discord, Feishu, and web crawls, as documented in SKILL.md and the various connector files in the reference/connectors/ directory.
Boundary markers: No explicit boundary markers (e.g., XML tags or specific delimiters) are used to isolate untrusted content from the agent's instructions, increasing the risk that the agent may follow instructions embedded within retrieved data.
Capability inventory: The skill utilizes shell-based tools via the mfs CLI (mfs search, mfs cat, mfs head) to retrieve and process this data, providing a vector for retrieved content to influence the agent's subsequent actions.
Sanitization: There is no evidence of content sanitization or filtering to prevent the agent from interpreting embedded instructions in the retrieved data.
[COMMAND_EXECUTION]: The skill's primary functionality is built around executing the mfs CLI tool within the host environment. While the instructions state that mfs is read-only, the skill frequently invokes shell commands to perform deep searches and file operations across the system and connected services.

mfs-find