The Agent Skills Directory

[DATA_EXFILTRATION]: The skill executes cat "$PROMPT_PATH" where the path is provided directly via user arguments. This creates a potential for unauthorized data exposure if a user provides paths to sensitive local files (e.g., SSH keys, configuration files, or environment secrets) instead of a prompt file.
[COMMAND_EXECUTION]: The skill uses the Bash tool to read and write files using paths derived from $ARGUMENTS. While the command uses quotes, passing external input to shell commands maintains a risk of command injection if the execution environment does not strictly sanitize the input metadata or if shell-specific characters are processed.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and processes untrusted content from external files that may contain instructions designed to override the agent's critique logic.
Ingestion points: Untrusted data enters the agent context in Step 1 via the cat command reading the file at $PROMPT_PATH (SKILL.md).
Boundary markers: The skill includes a defensive instruction at the beginning of the task description to prevent the interpretation of embedded markdown headers or instruction patterns as overrides, which mitigates but does not eliminate the risk.
Capability inventory: The skill possesses Read, Write, and Bash capabilities, which could be abused if the agent obeys instructions embedded within the draft prompt being analyzed.
Sanitization: There is no explicit sanitization or content validation performed on the file data before it is processed by the model for critique and rewriting.

prompt-critique-rewrite