The Agent Skills Directory

[PROMPT_INJECTION]: The skill collection implements workflows to ingest and summarize untrusted external documents including PRDs, PDFs, logs, and historical chat transcripts (as detailed in project-ingest and project-session-extract). This functionality introduces a risk of Indirect Prompt Injection, where instructions embedded in external files could influence the agent's behavior during processing. The current documentation does not define strict delimiters or isolation protocols to mitigate this surface.
[COMMAND_EXECUTION]: The provided Python utility scripts (llm_wiki_doctor.py and blackbox_eval.py) use the subprocess module to execute git commands for repository history and diff analysis. While implemented using safe practices such as list-based arguments and shell=False, these scripts process metadata from project-local markdown files that can be modified by the agent, which represents a potential attack surface.
[DATA_EXFILTRATION]: The project-ingest skill allows the agent to fetch and summarize content from arbitrary URLs provided by the user. This involves network requests to potentially non-whitelisted third-party domains. Although intended for legitimate document retrieval, these network operations could be leveraged as a data exfiltration vector if the agent is compromised by malicious instructions.

project-develop-copilot