The Agent Skills Directory

[DATA_EXFILTRATION]: The skill contains a feature that allows reading arbitrary files from the local filesystem.
Evidence: In scripts/_cmd_request.py, the cmd_create function processes the --body-file argument. It uses Path(body_file_raw).expanduser().resolve().read_text() to read content from the provided path and insert it into a plan document.
Risk: If an agent is manipulated into supplying a path to sensitive files (such as SSH keys or environment variables), the skill will read that data and store it within the project directory, potentially exposing it to other processes or users.
[PROMPT_INJECTION]: The skill facilitates indirect prompt injection by storing unsanitized content from external files.
Ingestion points: The body_file parameter in the create command within scripts/_cmd_request.py.
Boundary markers: Content is placed under the ## Original Input section in the markdown files, as specified in templates/request.md.
Capability inventory: The skill has the capability to read, write, and delete files in the plan directory (e.g., atomic_write_file, unlink) via the handlers in scripts/_cmd_request.py.
Sanitization: No validation or escaping is performed on the content imported from the external file. Malicious instructions embedded in these files could influence the agent's behavior when it later reads the generated document.

manage-plan-documents