The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through the task descriptions provided in the YAML configuration file (agent-tasks.yml). The TASK_DESCRIPTION is ingested and passed directly as instructions to a subagent without sanitization or boundary markers.
Ingestion points: Reads task entries from agent-tasks.yml or agent-tasks.yaml in Phase 1.2.
Boundary markers: Absent. The task text is interpolated directly into the subagent's system prompt in Phase 3.3.
Capability inventory: The agent has the ability to read the local filesystem, modify files, perform git operations (commit/push), and create pull requests.
Sanitization: Absent. There is no validation or filtering of the task text before it is used as instructions.
[DATA_EXFILTRATION]: There is a potential path for data exfiltration resulting from the indirect prompt injection risk. A malicious task description could instruct the subagent to search for and read sensitive local files (e.g., SSH keys, AWS credentials, or .env files). Because the parent agent is designed to automatically push changes and open pull requests (Phases 3.4 and 3.5), these secrets could be committed to the target repository and exposed publicly or to repository maintainers.
[COMMAND_EXECUTION]: The skill generates shell commands by interpolating variables extracted from the task file, such as the task description and repository name. For example, in Phase 3.1, the task text is used in an echo command within a backtick substitution. If the agent does not strictly escape these inputs, an attacker could potentially execute arbitrary commands on the host system (e.g., by including command substitution syntax like $(...) in the task description).

task-agent