The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from a shared issue tracker which could be modified by collaborators or third parties, creating a surface for indirect prompt injection attacks.
Ingestion points: The agent is instructed to "Load the map" and "fetch the full body of any related or closed ticket" from the external issue tracker (SKILL.md).
Boundary markers: There are no explicit delimiters or instructions defined to distinguish untrusted tracker content from agent instructions.
Capability inventory: The skill has the capability to invoke subagents (via /research) and use specialized tools (such as /prototype, /grilling, and /domain-modeling) based on the ingested content.
Sanitization: No sanitization, validation, or filtering of the ticket content is required before it is processed by the agent.
[DATA_EXFILTRATION]: The skill encourages the recording of sensitive system metadata in a collaborative environment, facilitating potential unauthorized discovery of assets.
Evidence: The description for "Task" type tickets in SKILL.md explicitly instructs the agent that the resolution "records what was done and any resulting facts (credentials location, new URLs, row counts) later tickets depend on." Recording credential locations in a shared tracker exposes sensitive file paths or configuration details.

wayfinder