The Agent Skills Directory

[DATA_EXFILTRATION]: The workflow executor's variable resolution logic explicitly allows accessing the system's environment variables.
Evidence: In workflows/executor.py, the VariableResolver class populates self.env_vars with dict(os.environ) and provides a path {{env.VAR_NAME}} to retrieve these values.
Impact: An attacker or a malicious workflow definition could use this to harvest sensitive credentials (e.g., AWS_SECRET_ACCESS_KEY, DATABASE_URL, API_TOKENS) by interpolating them into agent tasks or workflow outputs.
[INDIRECT_PROMPT_INJECTION]: The skill processes external input and interpolates it directly into instructions passed to AI agents without boundary markers or sanitization.
Ingestion points: The execute_workflow tool in mcp/servers/workflow-server/server.py accepts a JSON string of inputs via the user.
Boundary markers: None are present; inputs are directly substituted into the instruction string.
Capability inventory: The skill can trigger agent actions, read files via load_workflow, and access environment variables.
Sanitization: No escaping or validation is performed on the resolved strings before they are passed to the agent_executor.

workflow-builder