The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses a sensitive personal file path (~/Library/Mobile Documents/iCloud~md~obsidian/...) to read a family food profile. This path belongs to an Obsidian vault, which typically contains private, unencrypted notes and documents.
[DATA_EXFILTRATION]: The instructions include hardcoded personally identifiable information (PII), including a specific Gmail address and a detailed home address in San Jose, CA.
[COMMAND_EXECUTION]: The skill invokes an external binary dd-cli located at ~/.local/bin/dd-cli and a custom Python script included in the skill to perform actions, including financial transactions through the DoorDash API.
[PROMPT_INJECTION]: The skill processes untrusted data from external sources (DoorDash menu descriptions and store names) and potentially user-editable Markdown files, creating an attack surface for indirect prompt injection.
Ingestion points: The Family Food Profile.md file and the JSON output from dd-cli search and dd-cli menu commands.
Boundary markers: No explicit delimiters or "ignore instructions" warnings are utilized when processing this external content.
Capability inventory: The skill can execute shell commands, perform financial transactions via dd-cli order submit, and read/write files to the user's filesystem.
Sanitization: The provided Python script performs logical checks but does not sanitize or escape ingested strings before they are presented to the agent.

doordash