The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses sensitive agent configuration files located outside the project directory. As documented in SKILL.md, Phase 0.5 executes shell commands to read ~/.claude/mcp_config.json and ~/.claude.json. These files contain global configuration for the AI agent platform, including Model Context Protocol (MCP) server registries and potentially sensitive API keys.
[INDIRECT_PROMPT_INJECTION]: The skill presents a significant attack surface due to its core function of codebase exploration and multi-agent processing.
Ingestion points: Five separate discovery agents (Routes, Auth, Data, Framework, UX) are instructed to map the entire project codebase, reading all source files.
Boundary markers: Absent. The instructions provided to sub-agents do not include delimiting markers or warnings to ignore embedded instructions within the codebase data.
Capability inventory: The skill has the ability to spawn sub-agents (Task tool), perform network-based research (Perplexity, WebSearch), write documentation files to the local file system, and invoke external skills (trello-test).
Sanitization: The skill does not perform any validation, sanitization, or filtering of the codebase content before it is passed to the LLM sub-agents for analysis and generation.

test-spec-gen