The Agent Skills Directory

[DATA_EXPOSURE]: The skill is designed to read and write business-related data within the .business/ directory. While this involves sensitive business information, the operations are restricted to the local file system with no identified network exfiltration mechanisms.
[PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection because it ingests data from external sources like .business/context.md and customer evidence files.
Ingestion points: Files located in the .business/ directory and external customer evidence documents.
Boundary markers: The instructions do not define clear delimiters or include warnings to ignore instructions embedded within the ingested data.
Capability inventory: The skill has the capability to read files from the local directory and write new offer briefs to .business/plans/.
Sanitization: There is no explicit sanitization or validation of the content being read from external files before it is processed by the agent.

design-offer