The Agent Skills Directory

[PROMPT_INJECTION]: The skill's 'Self-Evolving' and 'Post-Execution Reflection' mechanisms instruct the agent to persistently modify its own instruction file (SKILL.md) and configuration files (references/backends.md). This constitutes a persistence mechanism that could be exploited to permanently inject malicious instructions into the agent's workflow.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its data processing workflow.
Ingestion points: Files in the target directory (code, markdown, PDFs, images) and external URLs via 'graphify add' (arXiv, X.com).
Boundary markers: None identified; untrusted content is passed directly to the extraction engine.
Capability inventory: The agent has access to 'Bash' (can execute commands), 'Read' (file access), and can modify the skill's own source code.
Sanitization: No evidence of input validation, escaping, or filtering of the processed content.
[CREDENTIALS_UNSAFE]: The instructions explicitly direct the agent to '../../references/backends.md' to access API keys and base URLs for various LLM backends, encouraging the storage of sensitive credentials in plain-text markdown files.
[COMMAND_EXECUTION]: The skill makes extensive use of the 'Bash' tool to run the 'graphify' CLI, execute shell commands like 'find' and 'scc' for directory analysis, and manipulate environment variables.
[EXTERNAL_DOWNLOADS]: The 'graphify add' command fetches academic papers from arXiv.org and social media content from X.com to incorporate them into the knowledge graph.

build-graph