The Agent Skills Directory

[COMMAND_EXECUTION]: The execution routing section in SKILL.md provides a launch command template that is vulnerable to shell command injection. The <TARGET> placeholder is wrapped in single quotes but not escaped, allowing an attacker to escape the argument and execute arbitrary shell commands (e.g., using '; command #).
[PROMPT_INJECTION]: The skill takes user-provided input for the target parameter and interpolates it directly into the system and user prompts for the gatherer agent in workflow.py and SKILL.md. There are no boundary markers or instructions to treat this input as data rather than instructions, which could allow a malicious user to hijack the subagent's behavior.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from untrusted or multi-user external sources including Slack, Jira, PagerDuty, and Git history.
Ingestion points: workflow.py (Phase 1) uses a Sonnet agent to gather data from these platforms.
Boundary markers: None. The gathered metrics are passed as raw JSON or text to subsequent agents.
Capability inventory: The skill has access to Bash, WebFetch, Read, and WriteArtifact tools.
Sanitization: There is no evidence of filtering or sanitizing the data fetched from external sources before it is processed by the Assessment and Reporting agents.
[PERSISTENCE]: The workflow implements a recurring monitoring loop in workflow.py using temporalio. By utilizing workflow.continue_as_new(inp), the skill can maintain a persistent execution state indefinitely on the host system, which could be abused to maintain long-term access if the workflow is compromised.
[DATA_EXFILTRATION]: The skill aggregates sensitive information from across a company's infrastructure (Observability, CI/CD, Incidents) and has the WebFetch (curl/wget) capability. A successful injection attack could allow an adversary to transmit collected metrics and incident data to an external server.

monitor