The Agent Skills Directory

[DATA_EXFILTRATION]: The index_repository tool requires an absolute path to a repository, allowing the agent to index any directory the host process can access. When combined with the get_code_snippet tool, this capability permits the extraction of file contents from potentially sensitive system or user directories beyond the scope of the intended project.
[PROMPT_INJECTION]: The skill ingests untrusted content from the indexed codebase, including source code and Architecture Decision Records (ADRs), creating a surface for indirect prompt injection where malicious instructions in the data could subvert agent behavior.
Ingestion points: index_repository (reads all files in the path), manage_adr (reads ADR documents), search_code and get_code_snippet (retrieves source text) as defined in SKILL.md.
Boundary markers: The skill does not implement delimiters or provide instructions to the agent to disregard embedded directives within the retrieved data.
Capability inventory: The skill provides tools for file reading (get_code_snippet), file modification (manage_adr), and complex database query execution (query_graph).
Sanitization: No sanitization, filtering, or validation of the ingested repository content is described.

tools-codebase-memory