The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is instructed to read content from sensitive local directories, including 04-projects/, 05-knowledge/, and 00-inbox/MY-PROFILE.md, to provide context for sub-agents. These sub-agents then execute WebSearch operations. This creates a trust-chain where private project details or profile information could be leaked to external search providers through generated search queries.
[INDIRECT_PROMPT_INJECTION]: The research phase specifically targets unvetted external sources such as GitHub READMEs, issues, Discord/forum discussions, and Twitter/X threads. This content is ingested and processed by the agent to generate strategic synthesis and local files. The absence of strict boundary markers or instructions to ignore embedded commands in the fetched data makes the skill vulnerable to indirect prompt injection, where an attacker could influence the strategic analysis or final recommendations.
Ingestion points: WebSearch and WebFetch operations in Phase 2, particularly the 'Emerging Tech' thread targeting developer forums and repositories.
Boundary markers: The prompt structure (e.g., EXISTING CONTEXT: [...]) does not include explicit warnings to the agent to disregard instructions found within the fetched content.
Capability inventory: The skill possesses the ability to spawn multiple background agents, perform web operations, and write synthesized results to the 05-knowledge/research/ directory.
Sanitization: No sanitization or filtering of external web content is described before synthesis.

auto-research