The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its processing of external 'audience constraints.' It is designed to fetch content from user-provided URLs (such as job descriptions or RFPs), which are untrusted sources. Malicious instructions embedded in these documents could attempt to override the agent's logic to exfiltrate vault data or insert unauthorized content into generated artifacts.
Ingestion points: The skill accepts external URLs or raw text for 'Audience constraints' as defined in SKILL.md.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore' commands to isolate the untrusted external content from the agent's core instructions.
Capability inventory: The agent has broad read access to sensitive local and remote files (the memory vault) and performs file writes and PDF rendering.
Sanitization: There is no evidence of sanitization or validation performed on the external audience constraint data before it is used to guide the tailoring process.- [DATA_EXFILTRATION]: The skill handles highly sensitive personal information stored in a 'personal memory vault.' This vault contains identity data, career history, and personal preferences, making it a high-value target for exfiltration.
Evidence: The skill explicitly reads from paths like people/<self>.md, projects/*.md, and playbooks/*.md.
Risk Factor: The skill mentions that vault content may be transmitted to 'external services' upon user invocation, and it uses the gh CLI to access private GitHub repositories, which increases the potential surface for data exposure if the session is manipulated.- [COMMAND_EXECUTION]: The skill uses a headless browser for dynamic artifact rendering, which presents a security risk. The process of converting tailored HTML into a PDF via 'Chrome headless' involves executing a browser engine on content that may be influenced by untrusted external inputs.
Evidence: The 'Method' section in SKILL.md specifies a rendering pipeline: 'tailored markdown → HTML template → PDF (via Chrome headless or equivalent).'
Risk Factor: If malicious code is injected into the HTML via a compromised 'audience constraint,' it could be executed within the headless browser to perform actions like accessing local files via the file:// protocol or making unauthorized network requests.

vault-to-artifact-tailor