The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process and modify all written output generated by the agent, including emails, Slack messages, and PR descriptions. This creates a vulnerability where malicious instructions embedded in the text being filtered could influence the agent's behavior during the processing phase.
Ingestion points: The skill ingests all prose output, specifically naming external-facing content like emails and Slack messages in SKILL.md (lines 17-23).
Boundary markers: There are no instructions to the agent to treat the text as untrusted data or to ignore any commands found within the prose.
Capability inventory: The skill performs text analysis, structural modification, and string replacement across various document types.
Sanitization: No sanitization or filtering is performed on the ingested text to prevent it from containing actionable instructions.
[DATA_EXFILTRATION]: The skill references file paths within the user's home directory (~/.claude/contexts/) to load voice calibration files. Accessing the home directory is a form of sensitive path exposure, even if the data is intended for local context usage.
Evidence: SKILL.md (lines 104-106) instructs the agent to "load the department-specific voice file from ~/.claude/contexts/{department}/voice.md".
[COMMAND_EXECUTION]: The skill's self-check procedure suggests using system tools to verify output quality, which involves running commands on potentially untrusted text output.
Evidence: SKILL.md (line 116) directs the agent to "grep output against Tier 1 list", which may involve calling shell commands with the generated text as an argument.

anti-ai-writing