The Agent Skills Directory

[DATA_EXFILTRATION]: The skill performs file system operations on the user's home directory (~/.agents/skills/). While it only uses ls to check for tool presence, accessing directories outside the immediate project scope is a potential privacy and data exposure risk.
[INDIRECT_PROMPT_INJECTION]: The skill reads untrusted content from multiple Markdown files within the llmwiki/ directory to generate its orientation report. This creates a surface for indirect prompt injection if the wiki content contains adversarial instructions.
Ingestion points: llmwiki/wiki/index.md, llmwiki/wiki/log.md, llmwiki/wiki/concepts/Architecture.md, and top concept files.
Boundary markers: None. The skill does not implement delimiters or specific instructions to ignore embedded commands within the ingested data.
Capability inventory: The agent can read and write files, and execute shell commands (grep, ls, test).
Sanitization: None. Data from the wiki is directly used to synthesize the output report.
[METADATA_POISONING]: The skill's description and its explicit RULE-01 state that it is 'read-only' and will not create or modify wiki files. However, the 'Delivery' section contains specific instructions to create a new draft file and append entries to llmwiki/wiki/index.md and llmwiki/wiki/log.md. This contradiction between safety claims and actual behavior is a form of metadata poisoning.
[COMMAND_EXECUTION]: The skill uses shell commands like grep, ls, and test to parse the file system and wiki content. While these are common utility commands, they are executed on potentially attacker-controlled file paths and content.

join-project