The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructs the agent to resolve core artifact paths from a project configuration file and explicitly permits absolute paths ('keep absolute paths absolute'). This allows a malicious repository to force the agent to read sensitive system files like SSH keys or password files by defining them in the configuration. Evidence is found in SKILL.md Step 0 resolution and Step 2 reading logic. This risk is highlighted by the fact that the 'Additional Warmup Paths' section specifically forbids absolute paths to prevent traversal.
[PROMPT_INJECTION]: The skill aggregates and summarizes content from numerous untrusted repository files, including AGENTS.md and custom project paths, to create a session handoff. This provides a vector for indirect prompt injection, where malicious instructions in these files can influence subsequent agent actions. The ingestion points include core artifacts and user-defined paths in SKILL.md Step 2. No boundary markers are defined to isolate the summarized content from the agent's instructions, and the skill does not perform validation or sanitization of the content before it is processed for the handoff.

aif-warmup