The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The file references/topic-sources.md instructs the agent to mine the user's shell history using the command history | grep -i error. Accessing shell history is a high-risk activity because users frequently execute commands that include plaintext API keys, authentication tokens, and passwords. This command exposes sensitive credentials to the agent's context.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and summarize all content within a specified blog directory during its 'ASSESS' phase in SKILL.md. Because the skill has access to powerful tools like Bash and Write, it is vulnerable to indirect prompt injection attacks. Malicious instructions hidden within scanned blog posts could trigger unauthorized actions.
Ingestion points: Phase 1, Step 1 in SKILL.md requires the agent to "Read all posts in the content directory."
Boundary markers: None. The instructions do not define delimiters or provide warnings to the agent to disregard instructions found within the data.
Capability inventory: Bash, Write, Edit, Task, Grep, Glob, and Read tools are all available to the skill.
Sanitization: Absent. The skill extracts themes, cross-references, and code snippets directly from the external files without validation or escaping.

topic-brainstormer