The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data—including error logs, git diffs, and terminal history—to derive new rules for the agent. This creates a risk where an attacker could embed malicious instructions within log files or code comments, which the skill might then extract and save into the agent's global instructions. * Ingestion points: Phase 1: Context Collection in SKILL.md identifies logs, diffs, terminal history, and conversation summaries as primary inputs. * Boundary markers: The skill does not define specific delimiters or boundary markers to isolate untrusted data during analysis, increasing the chance the AI follows instructions found within the data. * Capability inventory: The skill can write to sensitive global configuration files including ~/.copilot/copilot-instructions.md, skill definitions, and automation hooks. * Sanitization: While the Safety & Scope Gate in Phase 2.5 filters secrets and PII, it lacks explicit logic to detect or sanitize instruction-based injections.
[COMMAND_EXECUTION]: The skill is designed to modify and create automation hooks and skills under the ~/.copilot directory. These files govern how the agent executes tasks and interacts with the shell. The safe-auto mode allows the skill to apply small-to-medium updates without user confirmation, which could be leveraged to introduce subtle, malicious automated behaviors.

retro-copilot