The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection because it reads and processes user-controlled or externally-sourced markdown files in the wiki/ directory and uses them to generate answers.
Ingestion points: The agent reads wiki/index.md and various files under wiki/<type>/*.md as part of the core search and synthesis workflow.
Boundary markers: There are no instructions to the agent to treat the content of these files as data only or to ignore any instructions found within the wiki pages.
Capability inventory: The skill possesses the Write and Bash tools, which are used to update the wiki index, logs, and run configuration update scripts. An injection within a wiki page could potentially influence the agent to misuse these tools.
Sanitization: No evidence of sanitization or validation for content read from the wiki or written back to the synthesis pages.
[COMMAND_EXECUTION]: The skill uses the Bash tool to run local Python scripts for administrative tasks.
Evidence: It executes cogni-wiki/skills/wiki-ingest/scripts/config_bump.py to increment entry counts and optionally runs backlink_audit.py to manage internal links. These scripts are internal vendor resources used for the skill's intended functionality.
[COMMAND_EXECUTION]: The skill writes files to paths derived from user-influenced data (the synthesis slug).
Evidence: In Step 6 of the workflow, the agent chooses a slug based on the user's question and writes to wiki/<type>/{slug}.md. Without proper validation of the slug string, there is a risk of directory traversal or overwriting unintended files.

wiki-query