The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands, specifically grep -ril, to search for keywords within the .cockpit/ directory. These keywords are extracted directly from user queries, presenting a risk of command injection if the user input contains shell metacharacters that are not sanitized before execution.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and executes "procedure blocks" from local markdown files in the .cockpit/skills and .cockpit/workflows directories. An attacker who can influence the content of these files could execute arbitrary instructions through the agent.
Ingestion points: Files within .cockpit/knowledge, .cockpit/skills, and .cockpit/workflows.
Boundary markers: No delimiters or "ignore instructions" warnings are defined for the ingested data.
Capability inventory: File system read/write access (logs and signals), recursive skill loading, and shell command execution.
Sanitization: No explicit sanitization or validation logic is provided for the keywords used in shell commands or for the procedure steps being executed.
[DATA_EXFILTRATION]: The skill accesses files in a parent directory (../pk-shared/) relative to its own folder. While this is part of its design for sharing snapshots, this type of directory traversal increases the risk of unauthorized access to sensitive system files if the agent's file system permissions are not strictly restricted.

pk-consult