The Agent Skills Directory

[PROMPT_INJECTION]: The SKILL.md file contains a section titled 'MANDATORY USER VERIFICATION REQUIREMENT' which uses imperative and high-pressure language ('CRITICAL', 'MANDATORY', 'DO NOT') to override the agent's standard interaction model. It explicitly prohibits the agent from claiming success or marking tasks as complete without following a custom multi-step protocol, which is a technique used to bypass default operational guidelines.
[CREDENTIALS_UNSAFE]: The system_scan.py script is designed to locate and read sensitive files that typically contain secrets, specifically identifying .env, .env.example, .env.sample, and settings.py in its config_files list. Accessing these files during a system scan exposes potential credentials stored in environment variables.
[DATA_EXFILTRATION]: While no direct network exfiltration was found in the provided scripts, system_scan.py and verify_docs.py perform comprehensive reads of sensitive configuration and source files. The presence of logic to specifically target environment files creates a high risk of sensitive data exposure to the agent's context.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local codebase to determine documentation updates, creating a vulnerability to indirect injection.
Ingestion points: verify_docs.py ingests content from any .md, .rst, and .txt files found in the project directory, as well as scanning source code files.
Boundary markers: The skill does not use delimiters or provide instructions to the agent to disregard malicious instructions embedded within the codebase files it analyzes.
Capability inventory: The skill provides scripts for file system modification (update_docs.py) and codebase scanning, which are executed via shell commands.
Sanitization: Content extracted from documentation and code via regex is used to generate update plans without sanitization or validation of the text against malicious payloads.
[COMMAND_EXECUTION]: The skill's workflow relies on the execution of multiple Python scripts that perform deep introspection of the filesystem, including directory traversal and file reading, which provides a broad capability set for an attacker if the scripts were modified or if the input they process (the codebase) influences their execution parameters.

document-sync