The Agent Skills Directory

Indirect Prompt Injection (HIGH): The skill's primary function is to ingest untrusted data from local files or raw text for 'smart summarization' and 'intelligent chunking.'
Ingestion points: The input (file path) and text (raw string) arguments provide direct entry for external content into the agent's context.
Boundary markers: There are no markers or delimiters defined in the SKILL.md or type definitions to separate the untrusted data from the agent's core instructions.
Capability inventory: The skill processes this data to create 'information-dense' summaries intended for downstream LLM processing. This allows malicious instructions hidden in the input text to influence the agent's subsequent behavior.
Sanitization: No evidence of sanitization, filtering, or instruction-stripping is present.
Data Exposure & Credential Handling (MEDIUM): The 'Knowledge Protocol' in SKILL.md explicitly mentions integrating 'Confidential' and 'Personal' knowledge tiers, specifically stating it 'prioritizes the most specific secrets.'
This behavior is highly suspicious for a token usage utility. It suggests the skill may attempt to access sensitive files (like .env or credential stores) under the guise of 'optimizing' them, potentially leading to the inclusion of secrets in summaries or outputs.
Missing Implementation (INFO): The package.json file identifies scripts/analyze.cjs as the main entry point, but this file is missing from the skill package. This prevents verification of how the script handles the file paths or whether it executes arbitrary commands.

token-economist