The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from external 'registered sources' and follows 'damaged' pointers without explicit sanitization or boundary markers. If these sources contain malicious instructions, they could influence the agent's behavior during distillation, integration, or file management tasks.
Ingestion points: Files in the sources/ directory, including insights and damaged: pointers mentioned in §3 of SKILL.md.
Boundary markers: Absent; the instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings for external content.
Capability inventory: The skill performs file reads, writes, and deletions across sources/ and knowledge/ directories as described in §3, §6, and §7 of SKILL.md.
Sanitization: Absent; the agent is instructed to follow pointers and integrate claims directly without a validation step.
[COMMAND_EXECUTION]: The skill instructs the agent to resolve absolute root paths and delete directory contents based on user-supplied keys, which can be abused for unauthorized file operations.
Evidence: §1 describes resolving the 'absolute root path' and §6 describes deleting the sources/<key>/ directory and its files.
Risk: If the <key> identifier or note name is not properly validated, it could lead to path traversal and arbitrary file modification or deletion outside the intended knowledge base scope.
[DATA_EXFILTRATION]: The instruction to follow pointers to find content can be exploited to read sensitive files if the pointers are controlled by an attacker.
Evidence: §3 in SKILL.md states: 'Follow every damaged: pointer. It names the defect and where to find it.'
Risk: A poisoned source file could provide paths to sensitive files (e.g., SSH keys or environment variables), leading to their exposure in the agent's context or subsequent output.

kb-integrate