The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a 'context-injection' capability that surfaces user-controlled goal data directly into the agent's session prompt, creating a vector for indirect prompt injection.
Ingestion points: Data is ingested through the register and update-progress commands in scripts/goal_manager.py. Attackers can supply malicious instructions via arguments like --title, --intent, --accomplished, and --decisions.
Boundary markers: The cmd_context_block function in scripts/goal_manager.py generates the prompt injection block. While it uses textual headers (e.g., === ACTIVE GOALS (LHC) ===), it lacks explicit instructions to the LLM to ignore or treat embedded goal content as untrusted data.
Capability inventory: The skill has the capability to read and write files within the user's workspace (defaulting to ~/.aimee/workspace). It does not have network access or arbitrary command execution capabilities.
Sanitization: The script performs no sanitization, escaping, or validation of the text content provided in CLI arguments before interpolating it into the context-block output.
[DATA_EXPOSURE]: The goal management functions in scripts/goal_manager.py are vulnerable to path traversal attacks.
Evidence: The _read_goal and _atomic_write functions construct file paths by concatenating GOALS_DIR with the user-provided goal_id (e.g., path = GOALS_DIR / f"{goal_id}.json").
Impact: A maliciously crafted goal_id containing directory traversal sequences (e.g., ../../target) could allow the skill to read from or overwrite any .json file the current user has permissions to access outside of the intended workspace.

goal-manager