The Agent Skills Directory

[SAFE]: The skill uses system commands like find, grep, and cat to inspect local project files. This is standard behavior for a code analysis tool and does not involve unauthorized data access or exfiltration.
[SAFE]: Diagnostic patterns are used to identify hardcoded secrets, unauthorized identity providers, and insecure cookie settings in the audited codebase. This is a core feature of the skill's security auditing function.
[PROMPT_INJECTION]: Indirect Prompt Injection Risk: The skill processes untrusted data from local files which may contain malicious instructions.
Ingestion points: Files detected by find and read via cat or grep (e.g., package.json, source code, .env files).
Boundary markers: Absent. The skill does not wrap file content in delimiters or include instructions to ignore embedded prompts.
Capability inventory: File system enumeration (ls, find) and file reading (cat, grep).
Sanitization: Absent. Files are read and analyzed in their raw form.

gc-review-iam