The Agent Skills Directory

[DATA_EXFILTRATION]: The resolve_includes function in scripts/build_docx.py processes  sentinels within markdown drafts. It expands tildes and resolves absolute paths to inline file contents into the generated document. While intended for including tables or fragments, this functionality lacks path validation or sandboxing, allowing the inclusion of sensitive files such as SSH keys or credentials if their absolute paths are provided.
[INDIRECT_PROMPT_INJECTION]: The skill processes markdown drafts which may be influenced by external data. The file inclusion mechanism is triggered by a regex pattern, creating an attack surface where an attacker could inject sentinels to trick the agent into reading local system files. Evidence Chain: 1. Ingestion points: Markdown draft files (drafts/*.md) and project metadata (.planning/ACTIVE_WORKFLOW.md). 2. Boundary markers: None present for the file inclusion sentinels. 3. Capability inventory: File read access to arbitrary absolute paths via Path.read_text() and execution of document processing tools via list-based subprocess.run(). 4. Sanitization: The script checks if paths are absolute and exist but performs no validation against a whitelist or sensitive file patterns.

law-review-docx