The Agent Skills Directory

[DATA_EXFILTRATION]: Accesses hidden local file paths which may contain sensitive configuration data.
Evidence: The skill explicitly reads from ~/.pipa/communication-style.md and ~/.pipa/CONNECTORS.md as specified in SKILL.md. Hidden directories in the home folder are often used to store credentials, tokens, or sensitive connection metadata.
[PROMPT_INJECTION]: Vulnerable to indirect prompt injection via external data ingestion.
Ingestion points: The skill is designed to process data from external collaboration tools including Linear, Slack, Notion, and Jira (as described in evals/evals.json and tool discovery instructions in SKILL.md).
Boundary markers: There are no explicit delimiters or "ignore embedded instructions" warnings defined when the agent interpolates data from these untrusted external sources into its context.
Capability inventory: The skill uses composio-mcp for tool execution and explicitly mentions performing "external writes" to these systems.
Sanitization: No sanitization, escaping, or validation logic is present for the content retrieved from external APIs or local config files.
Mitigation: The skill includes a rule requiring explicit user approval and a preview of the scoped change before any external write is performed, which significantly reduces the risk of automated exploitation.

pipa-iteration-cycle