The Agent Skills Directory

[COMMAND_EXECUTION]: The init_case.py script, which is executed as part of the Phase 1 workflow, is vulnerable to path traversal. It uses a 'slug' generated by the agent from the case title to create directories and move files using os.path.join. Because the script does not validate or sanitize this input, a crafted case title could lead to a slug containing directory traversal sequences (e.g., ../../), potentially allowing the skill to write or overwrite files outside the intended ./case directory.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through the ingestion of untrusted data from multiple sources. Malicious instructions could be embedded in patient scenarios or found during the case discovery process on medical literature websites.
Ingestion points: Input SCENARIO.md files and web content retrieved via the /cps discover subcommand.
Boundary markers: The workflow relies on standard markdown headers but lacks explicit security delimiters or instructions to ignore embedded commands within the ingested text.
Capability inventory: The skill possesses the ability to execute shell commands, run Python scripts that modify the filesystem, and perform network operations through web searches.
Sanitization: No automated sanitization or filtering is applied to the ingested case data before it is processed by the agent's diagnostic personas.
[EXTERNAL_DOWNLOADS]: The skill encourages the use of web searches to find clinical cases and literature. Specifically, the /cps discover command and the optional lit-review CLI tool fetch data from external domains. While the instructions target reputable sources like NEJM and BMJ, the retrieved content is untrusted and integrated directly into the agent's reasoning loop.

cps