The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and processes untrusted data from external sources.
Ingestion points: The agent retrieves and scans the message field of Canvas course announcements and searches user emails via emails-search_emails to extract exam details.
Boundary markers: There are no explicit instructions or delimiters used to isolate external content from the agent's primary instructions, nor are there warnings to ignore potential instructions embedded within the messages.
Capability inventory: The agent has access to terminal-run_command, which allows for shell command execution, as well as the ability to read and write files in the workspace (e.g., exam_schedule.xlsx).
Sanitization: The instructions do not specify any validation or sanitization of the retrieved text before it is processed by the logic or the Python script.
Risk: An attacker with the ability to post course announcements or send emails to the user could embed malicious instructions (e.g., directives to delete files or exfiltrate data) that the agent might inadvertently execute while scanning for exam information.

canvas-exam-schedule-compiler