The Agent Skills Directory

[DATA_EXFILTRATION]: The configuration::get function supports automatic environment variable expansion using the ${VAR:default} syntax. When retrieving a configuration entry, the skill resolves these placeholders against the live process environment. This capability can be exploited to expose sensitive credentials, API keys, or tokens stored in the environment if an attacker or unauthorized process can register or modify configuration entries.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from untrusted or externally influenced sources, including the local filesystem (via the fs adapter watching ./config) and remote engines (via the bridge adapter). This data can trigger automated function execution through the reactive trigger system.
Ingestion points: Monitors YAML files in the ./config directory for external edits and accepts re-broadcasted events from remote engines through the bridge adapter.
Boundary markers: Implements JSON Schema validation to enforce the structure of configuration values, which serves as a basic boundary but does not validate the semantic safety of the data.
Capability inventory: Triggers matching handler functions (e.g., iii.registerFunction) asynchronously upon mutation events (registered, updated, deleted).
Sanitization: While JSON Schema validation is performed on the data shape, there is no evidence of sanitization to prevent embedded instructions from influencing downstream handlers or agent prompts.

configuration