The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is instructed to read the .env file to retrieve the ELASTIC_VERSION. While this access is specifically scoped to a non-sensitive version string for informational purposes, accessing environment configuration files is a sensitive operation that can potentially expose credentials or other environment variables if the instruction is modified.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests data from external sources to drive the generation of Elasticsearch configurations and scripts.
Ingestion points: Content is read from demo/{slug}-demo-script.md, demo/{slug}-discovery.json, data/{slug}-vulcan-queries.json, and opportunity/{slug}-opportunity-profile.json.
Boundary markers: The skill lacks explicit instructions to use delimiters or ignore instructions that may be embedded within the processed data files.
Capability inventory: The skill generates runnable Elasticsearch index mappings and ingest pipelines (found in SKILL.md and references/mapping-patterns.md), which include Painless scripts for data transformation and upsert logic.
Sanitization: There is no evidence of sanitization or validation of the input data before it is interpolated into the generated code and configurations.
[COMMAND_EXECUTION]: The skill generates and writes Elasticsearch Painless scripts at runtime. While these are executed within the Elasticsearch ingest context, the generation of dynamic code from untrusted inputs could be leveraged to execute malicious logic if the input files are compromised.

weave-model