The Agent Skills Directory

[DATA_EXFILTRATION]: The skill's troubleshooting section directs the agent to inspect sensitive file paths such as .env and credentials. While this is intended for debugging installation issues, reading these files can expose secrets and configuration details to the agent's context.
[COMMAND_EXECUTION]: The skill relies on executing local Node.js scripts (e.g., node scripts/install-plan.js) and system utilities (find, npm run) to provide real-time information about the repository. These operations are core to the skill's functionality but involve running executable code within the local environment.
[PROMPT_INJECTION]: User-supplied input is interpolated into shell commands for searching the repository (e.g., rg -n "<query>"). This creates a surface where a malicious user could attempt to escape the search command, although the impact is limited to the scope of the local files being searched.

ecc-guide