The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it ingests untrusted data from external sources and local files via the 'target' parameter and processes it using the Read and mcp__web-reader__webReader tools. The instructions do not specify any boundary markers or directives to isolate this external content from the agent's core instructions, creating a risk that malicious content in the source could override the skill's logic.
Ingestion points: The 'target' parameter in SKILL.md, which accepts URLs and local file paths for Source Briefs and Topic Notes.
Boundary markers: Absent. The instructions do not provide delimiters or 'ignore embedded instructions' warnings when reading external content.
Capability inventory: Read (file access), Write (file creation), WebSearch (external search), and mcp__web-reader__webReader (web scraping).
Sanitization: Absent. There is no evidence of validation, escaping, or filtering of the content retrieved from untrusted sources.
[DATA_EXFILTRATION]: The skill reads the local configuration file at '.loom/config.yaml' to determine vault paths and handles local file paths provided in the 'target' and 'output_dir' parameters. While these operations are consistent with the documented 'Loom' architecture and the skill's primary purpose, they represent a surface for data exposure if the agent is manipulated via prompt injection to access files outside the intended directories.

excavate