The Agent Skills Directory

[CREDENTIALS_UNSAFE] (HIGH): In references/codebase-understanding.md, the skill instructs the agent to "Analyze dotenv files and configuration." This constitutes a high-risk pattern as .env and other configuration files are primary locations for hardcoded credentials, API keys, and secrets.\n- [COMMAND_EXECUTION] (MEDIUM): The references/research-phase.md file directs the agent to execute shell commands such as repomix --remote <github-repo-url>. Running shell commands with remote URLs provided as input can lead to command injection or unauthorized network access if the URLs are not strictly validated.\n- [PROMPT_INJECTION] (LOW): The skill is susceptible to Indirect Prompt Injection (Category 8) due to its data ingestion patterns.\n
Ingestion points: The skill reads local codebase files, GitHub PRs, issues, and remote repositories via repomix (as seen in references/research-phase.md and references/codebase-understanding.md).\n
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the prompt templates when handling this external data.\n
Capability inventory: The agent can execute shell commands and spawn sub-agents based on the information gathered.\n
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from these untrusted external sources.

planning