The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it ingests untrusted data from external sources and integrates it into the agent's decision-making flow.
Ingestion points: External web content fetched via WebSearch and WebFetch, documentation retrieved via mcp__context7 tools, and various local codebase files (SKILL.md).
Boundary markers: Absent. The instructions do not specify the use of delimiters or warnings to the model to ignore instructions contained within the fetched data.
Capability inventory: The skill reads codebase patterns/configs, performs network operations, and ultimately transitions to a higher-privilege state by calling the EnterPlanMode tool (SKILL.md).
Sanitization: Absent. No sanitization, escaping, or validation of external content is defined before the data is synthesized.
[DATA_EXFILTRATION]: The skill performs network operations that could facilitate data exposure.
The research workflow involves reading sensitive configuration and dependency files (e.g., package.json, Gemfile, requirements.txt, .env structures) to find patterns and dependencies (SKILL.md).
This information is processed in the same context as network-enabled tools like WebSearch and WebFetch, creating a potential path for technical metadata to be included in outbound queries or retrieved content summaries.

research