The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructions in SKILL.md direct the agent to perform autonomous environment and filesystem lookups without user intervention. Specifically, it states: 'Finding facts is your job, never the user's. When a frontier question needs a fact from the environment (filesystem, tools, etc.), dispatch a sub-agent to find it; don't ask the user for anything you could look up yourself.' This pattern grants the agent a high degree of autonomy to read local files, which could lead to unintended exposure of sensitive configuration or data files if the agent determines they are relevant to the 'grilling' process.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted user input (plans, decisions, or ideas) and possesses the capability to read from the filesystem and execute tools based on that input. This creates an attack surface where a user could provide a plan that subtly directs the agent to 'verify' facts within sensitive directories.
Ingestion points: User-provided plans, decisions, or ideas mentioned in SKILL.md.
Boundary markers: None present in the prompt instructions to distinguish between user input and agent instructions.
Capability inventory: Sub-agent dispatch for filesystem and tool access as described in SKILL.md.
Sanitization: No validation or sanitization of user-provided plans is mentioned before the agent attempts to 'find facts' in the environment.

grilling