The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) because it is instructed to read the entire repository, including potentially untrusted content such as user-uploaded files, documentation, or code comments.
Ingestion points: The Exploration Workflow and Subagent Plan sections in SKILL.md direct the agent to scan routes, pages, database schemas, and all repository files.
Boundary markers: The instructions include some boundary markers like using TODO(confirm): and the core rule to treat the output as a draft, but these do not prevent the agent from being influenced by instructions embedded in the data it reads.
Capability inventory: The skill can read and write files, perform web searches, and spawn subagents.
Sanitization: There is no evidence of sanitization or filtering of the content ingested from the repository before it is used to influence the drafting process.
[DATA_EXFILTRATION]: The skill performs discovery of third-party services by inspecting sensitive files like env examples, config files, and database schemas. It then uses this information to perform external web searches for documentation.
Privacy Risk: While intended for research, this process can leak the specific technology stack, service providers, and integration patterns of the project to external search engines and third-party documentation sites.
Evidence: The Exploration Workflow (step 3 and 4) and references/provider-research.md explicitly instruct the agent to identify services like Stripe, Clerk, and OpenAI from configuration and then fetch their official documentation online.

legal-policy-drafter