The Agent Skills Directory

[DATA_EXFILTRATION]: The skill explicitly targets sensitive configuration files, specifically .env files, to extract DATABASE_URL and other service patterns. This behavior constitutes data exposure by bringing environment secrets into the active agent context.
[COMMAND_EXECUTION]: The skill's workflow includes the execution of arbitrary project commands extracted from package.json or Makefile and describes a dynamic background task system (Task()) for indexing and setup. It also implements PreToolUse hooks that trigger logic based on file paths and content.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection (Category 8) due to its core function of processing untrusted repository data.
Ingestion points: Repository structure scans, dependency file analysis (package.json, go.mod), and documentation reading (README, docs/).
Boundary markers: There are no documented boundary markers or instructions to the agent to disregard instructions found within the files it is analyzing.
Capability inventory: The agent can execute shell commands, record project memories, and initiate background sub-agent tasks.
Sanitization: No evidence of sanitization or validation of the codebase content is present before it is used to generate project documentation or influence agent policy management.
[PROMPT_INJECTION]: The use of 'Critical Rules' such as 'ALWAYS' and 'NEVER' in the generated CLAUDE.md is intended for project guidance but represents a mechanism where untrusted repo content could influence the agent's future behavioral constraints.

setup