The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill instructs the agent to resolve and read file paths provided as arguments, explicitly permitting paths that start with '/' or '~/', which covers the entire filesystem and the user's home directory.
This functionality allows the agent to read and potentially expose the contents of sensitive files such as SSH keys, cloud provider credentials (~/.aws/credentials), or environment files (.env) if requested.
While the skill's purpose is to restate text, the ability to read arbitrary system paths without restriction poses a significant data exposure risk.
[INDIRECT_PROMPT_INJECTION]: The skill processes external file content via the 'Read' tool, which introduces a risk of indirect prompt injection.
Ingestion points: The agent ingests data from local files as specified in the 'Resolving the Input' section of SKILL.md.
Boundary markers: The instructions include strict constraints on output (e.g., 'Just the plain version', 'No preamble') which act as partial boundaries, but there are no explicit instructions to ignore embedded commands in the processed data.
Capability inventory: The skill utilizes the 'Read' tool for file access and the 'AskUserQuestion' tool for user interaction.
Sanitization: The skill does not define any sanitization, filtering, or escaping mechanisms for the data retrieved from external files before it is processed by the assistant.

layman