The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructions require reading the project's .env file to retrieve sensitive credentials, including ES_API_KEY and KIBANA_API_KEY. While these are used for authenticating cluster probes, direct access to environment files is a standard data exposure vector.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through several ingestion points:
Ingestion points: Processes untrusted data from data/{slug}-data-model.json, demo/{slug}-demo-script.md, and demo/{slug}-platform-audit.json.
Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands within the processed files.
Capability inventory: The skill can perform network GET requests to cluster APIs, write files to the asset-bundle/ directory, and dispatch tasks to other platform skills.
Sanitization: No sanitization or validation of the contents of the ingested files is specified before they are used to drive the verification logic and asset authoring.

finish-verify