The Agent Skills Directory

[DATA_EXFILTRATION]: The skill takes a user-provided string dataFile and uses it directly in the file.read and file.write actions in workflow.yaml. This pattern allows for arbitrary file access and local data exposure if the input is not sanitized to prevent path traversal (e.g., providing ../../etc/passwd).
[DATA_EXFILTRATION]: Data retrieved from the user-specified path is written to a predictable location in /tmp/monthly-report-{{ $inputs.dataFile }}.json. This could lead to local data leakage on shared systems.
[PROMPT_INJECTION]: Indirect Prompt Injection Surface:
Ingestion points: External data is ingested via the file.read action in workflow.yaml using the path provided in $inputs.dataFile.
Boundary markers: No delimiters or warnings are present to instruct the agent to ignore embedded instructions within the ingested data.
Capability inventory: The skill has file system read/write access (file.read, file.write) and notification capabilities (system.notify).
Sanitization: No sanitization or validation is performed on the content of the data file before it is processed for the report.

monthly-report