The Agent Skills Directory

PROMPT_INJECTION (HIGH): The script scripts/evaluate_paths.py is vulnerable to Indirect Prompt Injection through file content aggregation.
Ingestion points: The script reads markdown files from the 03-paths/ directory (scripts/evaluate_paths.py, line 28).
Boundary markers: There are no delimiters or boundary markers used when merging content from individual paths into the evaluation matrix.
Capability inventory: The script writes a new file 04-verification/evaluation-matrix.md which is intended to be the primary source of truth for the agent's 'Verifier' persona during the next stage of reasoning.
Sanitization: None. The script extracts the first line of each path file (the title) and directly interpolates it into markdown tables and lists (scripts/evaluate_paths.py, lines 53-61). A malicious path file could use a crafted title (e.g., including markdown table syntax | or instructions like 'Ignore previous scores') to manipulate the evaluation matrix and subvert the agent's judgment.
COMMAND_EXECUTION (LOW): The script performs filesystem operations based on a user-controllable --workspace argument.
Evidence: The script constructs paths using the provided workspace directory without validating that the path remains within an intended sandbox (scripts/evaluate_paths.py, line 80).

deep-think