The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses and writes to a sensitive file path outside the project workspace. It constructs a state file at ~/.talos/<workspace>/<workflowName>/$CLAUDE_CODE_SESSION_ID/stages.json. Writing to hidden directories in the user's home folder is a sensitive operation that can be used to harvest environment details or store persistent data.
[COMMAND_EXECUTION]: The skill is instructed to perform environment preparation tasks, such as creating branches, worktrees, and switching directories. These actions are dynamically determined by the 'desc' field parsed from the .workflows/<name>/workflow.md file, allowing for arbitrary command execution if the workflow file is compromised.
[PROMPT_INJECTION]: The skill treats the contents of .workflows/<name>/workflow.md as the 'unique source of truth.' This creates an Indirect Prompt Injection vulnerability because the agent follows instructions (descriptions, completion criteria, and skip conditions) directly from a file that is likely part of the repository being analyzed.
Ingestion points: The skill reads logic and instructions from .workflows/<name>/workflow.md and user-provided workflow names.
Boundary markers: The skill lacks explicit boundary markers or instructions to ignore embedded malicious prompts within the workflow files.
Capability inventory: The skill can write files (stages.json), execute environment commands (branching, directory switching), and delegate arbitrary prompts to subagents via the Agent tool.
Sanitization: No sanitization or validation of the workflow file content is performed before it is used to drive agent behavior.

workflow