The Agent Skills Directory

[PROMPT_INJECTION]: The skill ingests data from external files such as findings/*.md, scope.md, and engagement-plan.md to verify findings and determine engagement scope. This creates an attack surface for indirect prompt injection, where maliciously crafted content or instructions within these files could influence the agent's logic or trigger unintended actions during the finalization process.
Ingestion points: The skill reads contents from findings/*.md, scope.md, and engagement-plan.md in Step 1 and Step 2 of the workflow.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to distinguish between trusted workflow commands and untrusted data read from these external files.
Capability inventory: The skill possesses significant capabilities, including file creation (mkdir), archiving (tar), secure deletion (shred), and Git repository management (git worktree).
Sanitization: The skill lacks instructions for sanitizing or validating the content read from external files before using it in logic checks or reporting.
[COMMAND_EXECUTION]: The skill provides multiple shell script templates that the agent is instructed to execute. These scripts perform powerful operations including recursive directory deletion (rm -rf), secure file wiping (shred -u), and Git worktree removal. While these tools are appropriate for the skill's stated purpose of cleaning up a security engagement, they represent a capability tier that requires careful oversight, especially when operating on paths derived from the local environment.

finishing-an-engagement