The Agent Skills Directory

[DATA_EXFILTRATION]: The chatter helper script is vulnerable to directory traversal. The slug parameter is concatenated with the root directory (root / slug) without sanitization, allowing an agent to be directed to read or write .md files in arbitrary directories on the filesystem.\n- [COMMAND_EXECUTION]: The skill executes local binaries (fswatch or inotifywait) via subprocess.run to monitor filesystem changes. While the calls use safe list-based arguments, they provide the agent with the ability to invoke external processes.\n- [PROMPT_INJECTION]: The skill processes untrusted data from other agents, creating an indirect prompt injection surface.\n
Ingestion points: The chatter script reads message content from .md files in the thread directory.\n
Boundary markers: Uses --- YAML frontmatter delimiters to separate metadata from content.\n
Capability inventory: The skill can write files and execute local monitoring tools.\n
Sanitization: Performs structural validation of the frontmatter but does not filter or sanitize message bodies.

chatter