The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill includes a sample codebase in the assets/ directory (assets/sample_codebase/src/user_service.py, assets/sample_codebase/src/payment_processor.py, and assets/sample_codebase/src/frontend.js) containing hardcoded dummy credentials and API keys (e.g., sk-1234567890abcdef, sk_test_EXAMPLE_NOT_REAL). These are explicitly documented as intentional anti-patterns for demonstration and testing of the scanner's detection capabilities.
[INDIRECT_PROMPT_INJECTION]: The debt_scanner.py script ingests and parses external codebase files. This creates an indirect prompt injection surface where malicious instructions could be embedded in code comments or string literals within a scanned project to influence the agent's interpretation of the resulting report.
Ingestion points: The debt_scanner.py script reads files from a user-specified directory path.
Boundary markers: The skill does not implement specific delimiters or 'ignore' instructions for the agent when processing the content of scanned files.
Capability inventory: The skill uses ast.parse for Python analysis and performs standard file read/write operations for reporting. It does not execute the target codebase.
Sanitization: The scanner uses structural analysis (AST) and regex patterns rather than executing the code, providing a layer of isolation, though it does not sanitize the text content for potential adversarial LLM instructions.
[COMMAND_EXECUTION]: The skill's primary workflow relies on the agent executing Python scripts (debt_scanner.py, debt_prioritizer.py, and debt_dashboard.py) via the command line to perform its functions.

tech-debt-tracker