The Agent Skills Directory

Prompt Injection (LOW): The skill instructs the agent to ingest content from the /knowledge/ directory for repurposing. There are no boundary markers (e.g., XML tags or delimiters) or instructions to treat this content as untrusted data, which creates a surface for indirect prompt injection if the source files contain malicious instructions.
Data Exposure (INFO): The skill is configured to read from sensitive context files such as /context/voice-dna.json and /context/business-profile.json. While this is intended for personalization, it establishes a pattern of accessing structured identity data that could be targeted by other malicious skills if they share the same agent context.
No Code (SAFE): The skill consists entirely of markdown instructions and YAML metadata. It does not include any scripts, executables, or package dependencies, significantly reducing the attack surface for remote code execution or persistence.

linkedin-post