The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructions direct the agent to access and read sensitive personal information stored in specific local filesystem paths.
Evidence: The skill explicitly targets $VAULT_ROOT/Personal/, $VAULT_ROOT/Profile/, and Employment/ directories.
Evidence: Instructions specifically mention querying sensitive data categories such as "health," "self-model," and "career."
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection because it processes data from external sources that could contain malicious instructions.
Ingestion points: The skill reads files from the $VAULT_ROOT/Library/ directory, which is described as containing "consumed sources, references, and learnings" from "the world."
Boundary markers: Absent. The instructions do not provide delimiters or warnings to ignore instructions embedded within the notes being read.
Capability inventory: The agent has the ability to execute shell commands (grep), read files, and write/create new pages in the vault.
Sanitization: Absent. There is no evidence of filtering or sanitizing the content retrieved from the vault before processing.
[COMMAND_EXECUTION]: The skill utilizes shell commands to perform its primary search and configuration tasks.
Evidence: Uses grep -ril to perform factual lookups across the vault.
Evidence: Uses echo to resolve the VAULT_ROOT environment variable.

ask