The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses untrusted inputs (prose or repository files) as the source for simulations, which creates an attack surface for indirect prompt injection. A malicious target input could contain embedded instructions designed to manipulate the agent's behavior during the simulation process.
Ingestion points: The Target input defined in SKILL.md allows the agent to ingest arbitrary text or the contents of files within the repository.
Boundary markers: The instructions do not specify the use of delimiters or clear boundary markers to isolate the Target content from the agent's own instructions.
Capability inventory: The skill possesses capabilities for reading arbitrary repository-relative files and writing the simulation output to a user-defined Markdown file (SKILL.md).
Sanitization: There is no requirement in the procedure to sanitize, validate, or escape the content of the Target input before it is processed.
[DATA_EXFILTRATION]: The skill allows the agent to read repository-relative files to act as the authoritative source for a simulation. This functionality enables the potential exposure of sensitive files—such as environment variables, configuration files, or credentials—if they are located within the accessible repository structure.
[COMMAND_EXECUTION]: The skill includes a step to write the generated callstack to a 'resolved destination' within the repository. This file-writing capability represents a potential attack surface if an adversary can influence the destination path or the content being written through a malicious Target input.

workflow-callstack-simulation