The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to read and analyze documents, which creates a surface for indirect prompt injection attacks.
Ingestion points: Document content is read in Step 1 from user-provided paths or the docs/ directory.
Boundary markers: The instructions do not define clear boundaries or provide warnings to the agent to ignore instructions embedded within the documents being reviewed.
Capability inventory: The skill possesses the ability to read arbitrary files (to verify claims) and write to the filesystem (to apply document edits in Step 6).
Sanitization: The skill lacks mechanisms to sanitize or filter document content before it is processed by the agent.
[DATA_EXFILTRATION]: The instruction in Step 2 to "Follow each checkable claim (file paths, function, command, or config names...)" to its source allows the input document to control the agent's file access. This could be exploited to trick the agent into reading sensitive files, such as environment variables or SSH configurations, and exposing their content in the final review report.
[COMMAND_EXECUTION]: The requirement to verify "command" names cited in documents creates a risk that the agent may attempt to execute these commands to check their validity or output, potentially leading to unintended code execution if the document content is malicious.

document-review