The Agent Skills Directory

[DATA_EXFILTRATION]: Exposure of host environment information through absolute file paths.
Evidence: The skill explicitly references C:/Users/nicol/.codex/get-shit-done/workflows/progress.md in the <execution_context> and <process> tags.
Impact: This reveals a specific local username ('nicol') and the user's directory structure, which constitutes a minor information disclosure of the execution environment.
[PROMPT_INJECTION]: Indirect prompt injection surface via externalized execution logic.
Ingestion points: The skill instructs the agent to read and execute the workflow defined in C:/Users/nicol/.codex/get-shit-done/workflows/progress.md (referenced in SKILL.md).
Boundary markers: There are no boundary markers or instructions telling the agent to treat the external file's content as data rather than instructions.
Capability inventory: The skill defines mappings that allow external workflows to use spawn_agent and request_user_input tools.
Sanitization: No sanitization or validation is applied to the content of the external Markdown file before the agent processes it.
[PROMPT_INJECTION]: Metadata poisoning through self-authoritative safety claims.
Evidence: The YAML frontmatter contains risk: safe.
Impact: This is an attempt to override safety evaluations by providing a pre-determined risk level, which can mislead users or automated scanners.

gsd-progress