The Agent Skills Directory

[DATA_EXFILTRATION]: The skill hardcodes absolute file system paths targeting a specific user's directory: /Users/lizhi/.workbuddy/. This practice reveals environment-specific information (username) and assumes a fixed directory structure, which could lead to metadata leakage or unauthorized file access if the environment is shared or improperly configured.\n- [COMMAND_EXECUTION]: The skill requires the agent to perform shell operations including ls for state inspection and git commit for integrating worker changes. These commands operate within the context of the user's local file system and could be manipulated if the agent's logic is influenced by malicious input.\n- [PROMPT_INJECTION]: The skill facilitates the spawning of sub-agents using user-provided goals and task descriptions, which represents an indirect prompt injection risk.\n
Ingestion points: User task definitions and parallel execution requests provided during the team trigger and TaskCreate steps.\n
Boundary markers: The skill does not define delimiters or specific instructions to ensure that user-provided content is treated as data rather than instructions when passed to worker agents.\n
Capability inventory: The sub-agents created by this skill have access to the Agent tool, bash execution, and file system modification.\n
Sanitization: There is no evidence of input validation, escaping, or filtering to prevent user content from hijacking the sub-agent's reasoning process.

team