The Agent Skills Directory

[PROMPT_INJECTION]: The skill employs authoritative and coercive language intended to override the agent's default task completion logic and safety boundaries. Phrases such as "CRITICAL: This skill defines a MANDATORY workflow", "You are forbidden from declaring task completion", and "ITERATION OVERRIDE RULE" represent attempts to hijack the agent's decision-making process and force specific behaviors.
[DATA_EXPOSURE]: The skill explicitly mentions that hidden files like .env may need to be included in the deliverable ZIP archive. Furthermore, the fallback command zip -r project_fallback.zip ./* uses a wildcard glob that captures every file in the current directory. This behavior poses a significant risk of unintentionally packaging and exfiltrating sensitive information, such as API keys, environment variables, or private configuration files, into a downloadable artifact.
[COMMAND_EXECUTION]: The skill provides explicit shell commands for archiving and listing files (zip, ls, unzip). While these are standard utilities, their application within instructions that encourage the inclusion of sensitive files increases the risk of data leakage.
[INDIRECT_PROMPT_INJECTION]: The skill defines a workflow where the agent must ingest and verify untrusted data (files in the project directory). Because it lacks explicit boundary markers or sanitization for this ingested content, it is potentially vulnerable to indirect prompt injection if a malicious file name or file content influences the agent's behavior during the 'Verify Project Completeness' or 'Inspect contents' steps.
Ingestion points: Reads files and directory structures in the local environment during the verification and archiving steps (SKILL.md).
Boundary markers: None provided to distinguish between internal instructions and ingested file data.
Capability inventory: Uses zip, ls, and unzip commands via the shell (SKILL.md).
Sanitization: No validation or filtering is performed on the files being archived.

finalize-zip-deliverable