The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains literal prompt injection payloads used as examples in the security documentation, specifically the phrase "IGNORE PREVIOUS INSTRUCTIONS". While these are labeled as potential attack vectors for the agent to be aware of, their presence in the instruction set can trigger security scanners and potentially interfere with the agent's behavior if the context of the warning is lost.
[INDIRECT_PROMPT_INJECTION]: The "Cognitive Chunking" mechanism involves the agent reading and processing fragments of external files. This creates a surface for indirect prompt injection where malicious instructions embedded in the processed data could influence the agent. The skill lacks explicit instructions for using boundary markers or sanitization during the chunking process, although these are discussed as potential guardrails in the documentation.
Ingestion points: Data read from external files during the chunking process (Step 1 in SKILL.md).
Boundary markers: Absent from the operational steps (1-4).
Capability inventory: File read/write access (scratchpad management) and usage of the task_boundary tool.
Sanitization: No specific sanitization or filtering logic is prescribed in the core instructions.
[DATA_EXFILTRATION]: The skill instructs the agent to create a .scratchpad.md file to store temporary cognitive data. As acknowledged in the skill's own security section, this file could contain sensitive tokens or architectural information handled during a task, representing a data exposure risk if the host environment does not perform secure cleanup. The documentation also explicitly references the sensitive path /etc/shadow as an illustrative target for exfiltration attacks.

working-memory