food-cal-order

The skill explicitly instructs the parsing of untrusted input from calendar event titles and descriptions (e.g., service, restaurant, items, allergies, delivery notes). These parsed values are then directly embedded into the `task` prompts for sub-agents spawned via `sessions_spawn`. A malicious calendar event could craft its title or description to include prompt injection payloads, which would then be executed by the sub-agent. Since sub-agents are instructed to perform browser automation using a Chrome profile with saved login and payment information, a successful prompt injection could lead to unauthorized actions such as exfiltrating credentials, placing fraudulent orders, or navigating to malicious websites, potentially overriding critical safety instructions.