The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands (date) to generate timestamps for filenames and logging displays.
[DATA_EXFILTRATION]: The skill contains two significant data exposure risks:
Arbitrary File Access: The 'Resume' feature allows the agent to read any file path provided in the user's initial $ARGUMENTS. This creates a Local File Read vulnerability where a user could provide a path to a sensitive system file (e.g., credentials or configuration), which the agent would then read and potentially leak to the user or external tools.
Insecure Log Storage: Detailed decision logs—which could contain sensitive information about the user's career, finances, and personal life—are written to the /tmp directory. On shared systems, this directory is often globally accessible, allowing other users to read the log contents.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its automated research capabilities:
Ingestion points: External data is ingested from the $ARGUMENTS parameter and from outputs generated by the web-researcher and WebSearch tools.
Boundary markers: The skill lacks delimiters or explicit instructions to ignore potentially malicious instructions embedded in the data retrieved from external sources.
Capability inventory: The agent possesses capabilities for file reading/writing, shell command execution, and spawning additional sub-agents via the Task tool.
Sanitization: There is no mechanism described for filtering or sanitizing research findings before they are incorporated into the decision log and synthesized into a final recommendation.

decide