The Agent Skills Directory

[PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill's primary function is to ingest and synthesize data from external, potentially untrusted sources.
Ingestion points: Workflow Step 2 in SKILL.md and the 'Source Material Types' section in references/intake-process.md specify the recursive reading of all files in a user-provided path, as well as the fetching of content from web URLs.
Boundary markers: There are no instructions to use delimiters or ignore embedded instructions within the source material during the indexing or synthesis process.
Capability inventory: The skill possesses the capability to read files, perform web searches (SKILL.md Step 5), and write new files to the filesystem (references/gap-analysis.md Vault Capture section).
Sanitization: The instructions do not prescribe any sanitization, filtering, or validation of the ingested content before it is processed by the agent.
[DATA_EXFILTRATION]: Potential for Sensitive Data Exposure. The skill's 'Read everything' directive creates a risk if a user provides a path containing sensitive information.
Evidence: references/intake-process.md explicitly instructs the agent to 'Read everything. Do not skip files based on filename, folder name, or file size' and to 'Traverse all nested folders to arbitrary depth.'
Context: While the skill requires user confirmation of the vault path, the lack of file-type filtering or sensitivity checks means the agent will attempt to ingest configuration files (e.g., .env, credentials), SSH keys, or other sensitive data if they exist within the confirmed directory structure.

research-intake