The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in references/CLAUDE-template.md and SKILL.md direct the agent to perform git add . followed by git push origin main. This approach stages every new and modified file in the repository, significantly increasing the risk of accidentally committing and pushing sensitive configuration files, temporary data, or unreviewed code changes.
[DATA_EXFILTRATION]: A dedicated reference file (references/secret-detection.md) provides algorithms and regex patterns to systematically scan the codebase for high-value secrets, including AWS_ACCESS_KEY_ID, STRIPE_SECRET_KEY, and DATABASE_URL. While intended for setup assistance, this functionality enables an agent to identify and access all credentials stored within the project environment.
[REMOTE_CODE_EXECUTION]: The 'Yolo Mode' feature (SKILL.md) describes an automated deployment process where the agent interacts with the Lovable.dev web interface using browser automation or MCP. While targeting a well-known service domain, this form of autonomous web interaction is a high-risk capability that could be misused to perform unauthorized actions if the agent's instructions are compromised.
[PROMPT_INJECTION]: The skill performs extensive scanning of project files to build codebase maps and identify configuration secrets. This ingestion of untrusted local data creates a surface for indirect prompt injection, where malicious instructions hidden in code or configuration files could influence the agent's behavior during the scanning process.

lovable