The Agent Skills Directory

[DATA_EXFILTRATION]: The skill automatically uploads a large corpus of sensitive work information to a remote Git repository.
Evidence: In Stage 3a and 3b of the SKILL.md file, the agent is instructed to run git add QPR/, git commit, and git push. The QPR/ directory contains raw data fetched from Gmail, Slack, Jira, and other sources.
Risk: If the user's Git remote is not strictly private or is shared with others, this automated push will expose private emails, chat logs, internal ticket details, and calendar events to unauthorized parties.
[PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection as it processes untrusted data from multiple external platforms.
Ingestion points: The skill pulls content from GitHub PRs, Slack messages, Gmail threads, Jira tickets, Confluence pages, and Google Docs (Stage 1).
Boundary markers: Absent. Subagents are not provided with instructions to delimit or ignore potentially malicious content found within the retrieved records.
Capability inventory: The skill utilizes powerful tools including Bash (executing git and gh), Write, Read, and Edit, which could be abused if an injection is successful.
Sanitization: Absent. The collected data is summarized directly into a narrative without filtering or escaping content that might contain instructions targeting the LLM.
[COMMAND_EXECUTION]: The skill performs automated shell command execution to manage data storage and transmission.
Evidence: Automated use of git add, git commit, and git push in the final stages of the skill workflow.

wk-self-perf