The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is configured to read any file path provided as a command-line argument through the <plan_path> #$ARGUMENTS </plan_path> directive. This capability allows an attacker to force the agent to read sensitive system files, such as .env files containing API keys, SSH private keys, or cloud provider credentials, into its active context.
[COMMAND_EXECUTION]: The skill utilizes dynamic context injection by placing the #$ARGUMENTS variable directly within a tag in the SKILL.md file. This pattern presents a high risk of command injection if the underlying platform evaluates this input through a shell or template engine without strict sanitization.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it processes untrusted content from external plan files and potentially their 'origin' documents. * Ingestion points: The primary implementation plan file and any referenced 'origin' documents. * Boundary markers: The instructions do not define any delimiters or provide 'ignore instructions' warnings to the agent, increasing the risk that the agent will follow malicious instructions embedded within the analyzed plans. * Capability inventory: The skill possesses extensive capabilities, including reading and writing files and invoking a suite of specialized 'systematic' research agents. * Sanitization: There is no evidence of validation or sanitization applied to the content read from the plan files before it is processed or used to rewrite the plan.

deepen-plan