The Agent Skills Directory

[DATA_EXFILTRATION]: The README.md file exposes a hardcoded absolute local path: /Users/choemun-yeong/.codex/skills/.system/skill-creator/scripts/quick_validate.py. This discloses the local username (choemun-yeong) and internal directory structure of the developer's system, leading to information exposure.
[COMMAND_EXECUTION]: The skill's verification checklist in SKILL.md and README.md instructs the agent to execute several shell commands, including npm run, uv run, npx, and git. While these are intended for development workflows, they provide a significant capability for shell interaction that could be leveraged if the agent is directed to work on a compromised repository.
[INDIRECT_PROMPT_INJECTION]: The skill processes and modifies application source code (GraphView.tsx, styles.css) and executes tests based on that code. This creates an attack surface for indirect prompt injection where malicious instructions inside the processed files could influence the agent's behavior.
Ingestion points: Source files located at apps/vault-ui/frontend/src/components/GraphView.tsx, apps/vault-ui/frontend/src/styles.css, and apps/vault-ui/frontend/src/App.tsx.
Boundary markers: Absent; there are no specific instructions or delimiters provided to help the agent distinguish between code and embedded instructions.
Capability inventory: Full shell execution capabilities via npm, uv, npx, and python are available to the skill during its verification phase.
Sanitization: Absent; the skill does not specify any sanitization or validation of the code content before processing it or executing related commands.

research-wiki-motion