The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface where malicious instructions embedded in processed data could influence the agent's behavior, particularly regarding file system operations.
Ingestion points: The skill ingests untrusted source material such as user-provided notes, transcripts, and briefs in references/stage-intake.md.
Boundary markers: There are no explicit instructions or delimiters (like XML tags or clear 'ignore' warnings) used to separate the processing instructions from the external source content, increasing the risk of the agent obeying instructions hidden within that data.
Capability inventory: The skill contains powerful file-write capabilities in references/stage-approve.md and references/stage-transform.md, which instruct the agent to save output files directly to the local filesystem (specifically ~/Desktop or a directory defined by $KERNEL_WRITE_OUTPUT_DIR).
Sanitization: The skill does not provide any logic or instructions to sanitize the input data or the generated 'slugs' used for filenames. This lack of validation could potentially be exploited by an attacker to perform path traversal or overwrite sensitive files if the agent is coerced via the source material.

write-essay