The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands like find, grep, and tree to perform its primary function of repository analysis. It interpolates user-provided paths (e.g., repo_path) into these commands, which could lead to command injection if inputs are not properly sanitized.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests and summarizes untrusted file content from the repositories it scans, creating a surface for embedded instructions to influence the agent's behavior.\n
Ingestion points: File contents from the target repository read during detection and summarization phases.\n
Boundary markers: Absent; untrusted content is processed without explicit delimiters or instructions to ignore embedded commands.\n
Capability inventory: Includes Bash for command execution and Write for caching results.\n
Sanitization: No sanitization is performed on the content before summarization.\n- [DATA_EXFILTRATION]: The skill is specifically designed to identify sensitive data types (PII, credentials, financial data) and store them in a local cache directory (~/.ghost/repos/). Although network access is forbidden, the aggregation of sensitive data in a predictable local path constitutes a data exposure risk.

ghost-repo-context