The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from the web and existing files to generate new agent instructions.
Ingestion points: Reads content from skills/${var}/SKILL.md, web search results, and internal memory logs.
Boundary markers: The instructions do not define clear delimiters or boundary markers to isolate untrusted external content from the generation prompt.
Capability inventory: The skill has high-privilege capabilities including writing files (skills/${var}/SKILL.md), executing git commands, and making network requests via curl.
Sanitization: There is no evidence of sanitization or validation of the ingested content before it is incorporated into the new versions of the skill files.
[COMMAND_EXECUTION]: The skill performs various shell operations to manage the evolution process, including file system writes to overwrite existing skills and git commands (git checkout, git commit, git push, gh pr create) to automate code deployment. It also utilizes curl for network access.
[DYNAMIC_EXECUTION]: The skill's primary function is the automated generation and execution of new instructions. By overwriting its own or other skills' logic based on potentially poisoned external data, it could inadvertently persist malicious behavior within the agent's workspace.

autoresearch