The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process arbitrary, untrusted data from local file systems and external web URLs, creating a vulnerability to indirect prompt injection. 1. Ingestion points: Local files (Obsidian vaults, markdown notes, reference documents) and web URLs provided by the user or discovered during research (SKILL.md, references/intake-process.md). 2. Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings when processing external content. 3. Capability inventory: The skill has the capability to recursively read files, perform web searches, and write new files to the filesystem (SKILL.md, references/gap-analysis.md). 4. Sanitization: No sanitization or validation of the ingested content is mentioned before it is synthesized into a knowledge map or used to generate new research.
[DATA_EXFILTRATION]: The skill's instructions mandate reading all files in a provided directory regardless of their name or format, which creates a data exposure risk. Evidence: 'Read everything. Do not skip files based on naming or format assumptions. Read everything' (references/intake-process.md). This directive potentially exposes sensitive files (e.g., .env, .ssh/config, .aws/credentials) if the agent is directed to a broad directory path. While the workflow includes a confirmation step, the instruction to ignore filename-based filtering increases the risk of accidental data exposure during the indexing process.

research-intake