The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains a 'Self-Evolving Skill' header that instructs the agent to modify the skill's source markdown file based on its performance or user requirements. This creates a persistent instruction override mechanism where runtime context or user input can permanently alter the skill's logic, a pattern that can be exploited for long-term poisoning.
[COMMAND_EXECUTION]: The skill executes a local TypeScript script (pushover_core.ts) using the bun runtime. The command implementation utilizes shell expansion ($(cc-plugin-root ...)) to resolve paths and unsets proxy environment variables (env -u HTTPS_PROXY) to ensure direct network communication.
[DATA_EXFILTRATION]: The skill transmits user-defined content, including titles, messages, and file attachments, to the Pushover API. While this is the core purpose of the notification skill, there are no instructions provided to the agent to sanitize or prevent the inclusion of sensitive data (such as environment secrets or private logs) in the notification payload.
[PROMPT_INJECTION]: The skill functions as a platform for indirect prompt injection by ingesting untrusted data (like incident reports or error messages) into the notification parameters without boundary markers or sanitization logic. Specifically:
Ingestion points: The --title, --message, and --attach parameters in the bash command.
Boundary markers: Absent; there are no delimiters to separate the message content from the agent's instructions.
Capability inventory: Subprocess execution via bun and network transmission to the Pushover API.
Sanitization: Absent; the skill does not instruct the agent to escape or filter the content before interpolation.

emergency-priority2-receipt