The Agent Skills Directory

[PROMPT_INJECTION]: Vulnerable to indirect prompt injection due to the ingestion of untrusted data from error logs, diffs, and conversation summaries to generate configuration updates.
Ingestion points: Ingests logs, terminal history, and conversation context (defined in SKILL.md Phase 1).
Boundary markers: Lacks explicit delimiters or instructions to ignore embedded directives in the ingested data.
Capability inventory: Permissions to write to multiple files in ~/.copilot, including executable hooks and MCP configurations.
Sanitization: Relies on an LLM-based "Safety & Scope Gate" which can be bypassed by adversarial content.
[DATA_EXFILTRATION]: Accesses and modifies sensitive user configuration files within the ~/.copilot directory, specifically targeting mcp-oauth-config, permissions-config.json, and settings.json which may contain credentials or internal environment details.
[COMMAND_EXECUTION]: Modifies automated behavior definitions in ~/.copilot/hooks/**/*.json and tool configurations in mcp-config.json. The "safe-auto" mode allows the skill to apply these changes without user review, creating a potential path for persistent command execution if malicious logic is successfully injected into the source data.

retro-copilot