The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user-provided paper files in the problem_files/ directory and various project manifests to generate its auditing reports and task lists.
Ingestion points: The skill reads all content within problem_files/ and processes multiple JSON manifests (e.g., model_results.json, run_manifest.json) in the paper_output/ directory.
Boundary markers: There are no explicit boundary markers or instructions provided to the agent to disregard malicious content embedded within these ingested files.
Capability inventory: The skill utilizes Python scripts (pipeline.py and evidence_gate.py) which have the capability to read from and write to the local file system.
Sanitization: No significant sanitization or validation is performed on the file paths or content extracted from JSON manifests before they are used in file operations.
[DATA_EXFILTRATION]: The auditing logic in scripts/evidence_gate.py permits the processing of absolute file paths provided in manifests, which allows the script to read and hash files outside the project workspace.
Evidence: The resolve_artifact function explicitly allows absolute paths with if path.is_absolute(): return path. This path is then passed to sha256_file, which opens and reads the file to calculate its SHA-256 digest.
Risk: While the script does not directly send file contents over a network, the ability to verify the existence and state of sensitive system files via their hashes constitutes a data exposure risk if an attacker can control the manifest inputs and observe the generated audit reports.

quality-assurance-auditor