The Agent Skills Directory

[DATA_EXFILTRATION]: The skill explicitly directs the agent to access and inspect sensitive file paths, specifically .env files (including .env.local and .env.production) to identify configured services. While the instructions include a safety constraint to surface only key names and not values, programmatically accessing these files is a high-risk activity that could lead to accidental credential exposure or data harvesting if the constraints are bypassed.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data from various repository files, such as README.md, package.json, and framework configurations.
Ingestion points: package.json, README.md, .mcp.json, and environment files within the active repository.
Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within the files it processes.
Capability inventory: The agent context includes file system read access and potential tool execution based on the audit recommendations.
Sanitization: No sanitization or validation of the content read from the repository files is mentioned, allowing maliciously crafted content in a README.md or package.json to potentially influence the agent's audit summary or recommendations.

workspace-surface-audit