The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting untrusted user data for lookup operations. \n
Ingestion points: The <control-id> and <framework> parameters provided by the user are directly interpolated into search queries and tool commands in SKILL.md. \n
Boundary markers: The skill does not provide boundary markers or explicit instructions to ignore embedded commands when processing or displaying resolved control data. \n
Capability inventory: The skill has access to the Read, Bash, Glob, and Grep tools, which can be leveraged if injection occurs. \n
Sanitization: There is no evidence of sanitization or input validation instructions to prevent the agent from executing instructions embedded within the control definitions it reads. \n- [COMMAND_EXECUTION]: The skill performs dynamic path construction and command invocation using user-derived variables. \n
Evidence: In Step 3, the instruction to read skills/<framework>-expert/SKILL.md dynamically constructs a file path based on a 'best-guess' framework identifier. Without proper validation of the <framework> string, this pattern introduces a risk of path traversal if the agent attempts to read files outside the intended directory. Additionally, the use of user input in internal command calls like /grc-engineer:map-controls-unified poses a surface for argument injection.

control-explainer