The Agent Skills Directory

[METADATA_POISONING]: The SKILL.md file identifies the author as openai, which contradicts the actual source tristanmanchester. This misleading attribution leverages the reputation of a well-known organization to gain unearned trust in the skill's advice and security.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process complex, untrusted user-provided inputs to generate decision memos, forecasts, and script inputs without sufficient security boundaries.
Ingestion points: User-provided scenarios, plans, and criteria processed in SKILL.md and templates within the assets/ directory.
Boundary markers: The templates lack explicit delimiters or instructions to ignore embedded commands within user data.
Capability inventory: The skill executes local Python scripts (scripts/decision_matrix.py, scripts/ev_scenarios.py) and has the capability to write files to the local system.
Sanitization: There is no evidence of validation or escaping for user-supplied strings before interpolation.
[COMMAND_EXECUTION]: The bundled Python scripts scripts/decision_matrix.py and scripts/ev_scenarios.py include an --output parameter that allows the agent to write the results to any file system path. If the agent is successfully influenced by a prompt injection, this could be used to overwrite sensitive files or configuration.

wordly-wisdom