The Agent Skills Directory

[DATA_EXFILTRATION]: The skill reads from potentially sensitive directories that may contain credentials or secrets.
Evidence: Step 2 performs a recursive grep across the .config/ and .github/ directories, which are common locations for configuration secrets, environment files, and CI/CD credentials.
[INDIRECT_PROMPT_INJECTION]: The skill processes content from documentation and code which could contain malicious instructions designed to manipulate the agent's output or actions.
Ingestion points: Reads data from .internal-docs/ and various codebase directories using the Grep and Read tools.
Boundary markers: The skill does not implement boundary markers or instructions to disregard instructions embedded in the data being processed.
Capability inventory: The skill has the ability to execute shell commands using Bash (Step 4), which can be derived from the contents of the files it reads.
Sanitization: No sanitization is performed on the content retrieved from files before it is used to generate responses or presented as commands for execution.
[COMMAND_EXECUTION]: The skill facilitates the execution of shell commands discovered within the analyzed files.
Evidence: Step 4 asks the user to confirm the execution of commands found in the documentation or codebase. While confirmation is required for state-mutating commands, this still allows for the execution of arbitrary code if a user is misled by compromised documentation.

ask-internal