The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructions in references/codebase-understanding.md explicitly direct the agent to 'Analyze dotenv files and configuration'. Accessing sensitive files like .env is a high-risk activity as these files typically contain API keys, database credentials, and other secrets.\n- [EXTERNAL_DOWNLOADS]: The references/research-phase.md file provides a command example using repomix --remote targeting an untrusted GitHub repository (https://github.com/mrgoonie/human-mcp). This encourages the downloading and processing of external code from sources that are not verified or trusted.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from multiple untrusted external sources, creating an attack surface for indirect prompt injection.\n
Ingestion points: The skill reads GitHub PRs, issues, and action logs via the gh command, fetches external documentation through docs-seeker, and analyzes remote repositories using repomix (references/research-phase.md). It also incorporates reports from scout and researcher agents (references/codebase-understanding.md, references/research-phase.md).\n
Boundary markers: There are no instructions or delimiters provided to help the agent distinguish between its own system instructions and potentially malicious instructions embedded in the external data it processes.\n
Capability inventory: The skill can spawn additional agents, execute shell commands (like gh and repomix), read sensitive local files, and write to the local file system.\n
Sanitization: The provided instructions do not include any steps for sanitizing, validating, or filtering the data retrieved from external and untrusted sources.

planning