The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill instructs the agent to perform an outbound network request to check for updates. It transmits the skill's current version number to an external domain that is not on the whitelisted or well-known service list.
Evidence: curl -fsSL --max-time 2 "https://nextmovetheory.com/version?skill=nmt-diagnose${v:+&v=$v}" found in the Update check section of SKILL.md.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data regarding product metrics, segment definitions, and roadmaps to generate its diagnostic results. This data is then used to influence downstream actions, including generating files and recommendations.
Ingestion points: User-supplied product stage, Core Job hypotheses, and current roadmap initiatives (Sections 2 and 3 of SKILL.md).
Boundary markers: No specific delimiters or instructions to ignore embedded commands within the ingested data are present.
Capability inventory: The skill has the capability to write files (Skills-Results/{project}/diagnose/...) and perform network operations (curl for version checks).
Sanitization: There is no evidence of input validation, filtering, or escaping for the data provided by the user.

nmt-diagnose