The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from an external issue tracker, which could contain instructions to manipulate the agent's logic.
Ingestion points: The agent reads issue bodies and question sections from the repository's issue tracker (SKILL.md).
Boundary markers: While it uses markdown headers to organize the map and tickets, it lacks explicit instructions for the agent to ignore instructions embedded in the user-provided issue content.
Capability inventory: The agent can push new branches to the git repository and invoke specialized tools like research and prototype (SKILL.md).
Sanitization: There is no instruction to sanitize or validate the content retrieved from the issue tracker before processing.
[DATA_EXFILTRATION]: The Research ticket workflow facilitates the movement of local data to a remote repository.
Mechanism: The skill defines a Research ticket type that instructs subagents to read local resources and knowledge bases outside the current working directory and push findings to a research branch (SKILL.md).
Risk: This pattern could result in the exposure of sensitive local files or environment configuration if the agent's research identifies them as relevant findings and uploads them.

wayfinder