The Agent Skills Directory

[DATA_EXFILTRATION] (MEDIUM): The skill defines configuration parameters for auto_push and git_remote in SKILL.md. While these are intended for a 'Git Time Machine' feature to enable undo/redo functionality, they represent a high-risk exfiltration vector. An attacker could use the SET GIT REMOTE command to point to a malicious server and enable auto_push to exfiltrate the simulation state or other files in the directory.
[DATA_EXFILTRATION] (LOW): The transcript_path parameter in SKILL.md allows the agent to specify where session logs are written (e.g., ./README.md, ./logs/session-log.md). If path sanitization is not strictly enforced by the agent framework, this could be exploited to overwrite sensitive files or write data to locations outside the intended simulation directory.
[COMMAND_EXECUTION] (LOW): The skill documentation mentions several commands (TICK, REWIND, BRANCH, MERGE) that imply underlying shell or Git execution. While these are presented as high-level simulation controls, they require the agent to have significant permissions over the local filesystem and version control system.
[PROMPT_INJECTION] (SAFE): No explicit prompt injection patterns, bypass markers, or role-play jailbreaks were detected in the skill instructions or metadata.
[DATA_EXFILTRATION] (LOW): This skill exhibits an indirect prompt injection surface.
Ingestion points: The skill reads simulation state from YAML files (e.g., ADVENTURE.yml, SIMULATION.yml) using read_file.
Boundary markers: No specific delimiters or safety warnings for embedded instructions are defined in the schema.
Capability inventory: The skill has write_file and Git push capabilities.
Sanitization: No evidence of sanitization for data read from the simulation state files before it is processed or used in logic.

simulation