The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads from and writes to user-controlled files, creating an attack surface for indirect instructions.
Ingestion points: The skill reads NOTES.md at several stages to ground itself in the user's workflow and tool access map.
Boundary markers: The instructions do not define boundary markers or sanitization rules for data read from NOTES.md before it is used to influence the agent's behavior.
Capability inventory: The skill is capable of writing markdown files to the local automations/ directory. It does not have access to subprocesses, network tools, or code execution environments.
Sanitization: No evidence of input filtering or escaping was found in the provided files.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill intentionally collects information about sensitive data and internal tool access.
Description: The skill's primary purpose involves documenting the user's role, recurring work, sensitive-data constraints, and tool access map (including internal APIs and service accounts).
Evidence: Instructions in SKILL.md and references/vocabulary.md direct the agent to record 'data sensitivity' and 'tool access' in NOTES.md.
Risk Assessment: While the skill handles sensitive organizational context, all data remains within the local workspace; no network exfiltration patterns or external downloaders were detected.

delegate-my-work