The Agent Skills Directory

[DATA_EXFILTRATION]: The skill contains a directive to "Read everything" and explicitly instructs the agent to "not skip files based on naming or format assumptions" (found in SKILL.md and references/intake-process.md). This behavior presents a significant risk of exposing sensitive files such as .env, .ssh keys, or configuration files if a user inadvertently provides a broad directory path. The lack of file-type filtering or exclusion lists for known sensitive paths makes this a data exposure concern.
[INDIRECT_PROMPT_INJECTION]: The skill processes arbitrary content from local files and user-provided URLs as part of its core workflow. It lacks security measures such as boundary markers or specific instructions to disregard commands found within the ingested material.
Ingestion points: Workflow Step 2 in SKILL.md and the 'Source Material Types' section in references/intake-process.md (reads recursive local files and web URLs).
Boundary markers: None present; no instructions to isolate or treat ingested data as untrusted.
Capability inventory: File system read access, web search/URL retrieval, and file system write access ('Vault Capture' in references/gap-analysis.md).
Sanitization: No evidence of sanitization or validation of the content retrieved from files or URLs.
[EXTERNAL_DOWNLOADS]: Automated security scanners have flagged the skill's documentation URL (https://jeffallan.github.io/writing-with-agents/skills/research/research-intake/) as being on a blacklist. The skill also facilitates the retrieval of content from arbitrary external URLs which are not validated against a trust list.

research-intake