The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructs the agent to inspect sensitive process information, specifically recommending the use of /proc/<pid>/environ to observe environment variables. This file is a high-risk source for data exposure as it frequently contains API keys, database credentials, and other secrets for running processes.\n- [DATA_EXFILTRATION]: The instructions establish a policy where 'Reading production is the default' for gathering evidence. Although it includes a caution about obtaining permission for changes, the broad mandate to read production logs, metrics, traces, and diagnostics by default creates a significant risk of accidental exposure of sensitive production data.\n- [INDIRECT_PROMPT_INJECTION]: The skill's verification workflow relies on the agent ingesting and analyzing potentially untrusted data from modified systems, creating an attack surface for indirect prompt injection.\n
Ingestion points: Workflow steps 5 and 6 in SKILL.md designate timestamped logs, database rows, API responses, and process states as primary evidence sources for the agent to inspect.\n
Boundary markers: Absent; the instructions provide no guidance on using delimiters or safety markers to isolate these potentially malicious inputs from the agent's instructions.\n
Capability inventory: The skill grants the agent capabilities for shell command execution, process manipulation (kill), and dynamic script creation across SKILL.md and reference/techniques.md.\n
Sanitization: Absent; there is no instruction for the agent to sanitize, escape, or filter retrieved logs or state data before analyzing them for proof.\n- [DYNAMIC_EXECUTION]: The skill encourages agents to dynamically generate and execute testing infrastructure, including building fakes for external services, creating reusable validation tooling, and writing custom proof scripts. This runtime generation of executable logic significantly increases the agent's attack surface.

proving-changes