The Agent Skills Directory

DATA_EXFILTRATION (MEDIUM): The functions/verify_extractor.py script opens and reads files from paths provided directly as command-line arguments. Because there is no validation to ensure the path resides within a specific directory, an attacker could potentially influence the agent to read sensitive files like SSH keys or environment variables.- COMMAND_EXECUTION (LOW): The functions/verify_extractor.py script is designed to parse and output shell commands found within markdown code blocks. This behavior constitutes an Indirect Prompt Injection surface. If an attacker can modify a task markdown file, they can insert malicious commands that the agent might subsequently execute.
Ingestion points: Reads task markdown files (functions/verify_extractor.py).
Boundary markers: Commands are extracted from sections delimited by ## Verify and markdown code blocks.
Capability inventory: The script itself does not execute commands but serves them to the agent's shell for execution.
Sanitization: None; the script extracts raw text from code blocks, excluding only comments.- PROMPT_INJECTION (LOW): functions/index_updater.py and functions/task_formatter.py interpolate user-provided descriptions and titles into markdown templates. While intended for documentation, these can be used to inject instructions that might influence the agent when it later reads the generated README or task files.

nav-task