The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from repository diffs and code snippets without explicit sanitization or boundary markers.
Ingestion points: The skill reads changed_files, diff_snippets, and repo_context in SKILL.md and its subskills.
Boundary markers: No explicit delimiters or instructions are provided to the model to ignore potential instructions embedded within the code comments or commit messages being analyzed.
Capability inventory: The skill has the capability to read local files and write to an external Notion workspace via the Notion MCP tool described in subskills/notion-page-publisher.md.
Sanitization: There is no mechanism to filter or escape content from the code snippets before they are interpolated into the final documentation.
[DATA_EXFILTRATION]: The skill is designed to summarize and publish information about sensitive architectural layers to an external platform.
Evidence: subskills/diff-risk-evaluator.md specifically targets sensitive file paths including /auth/, security, config, and .env for analysis.
Risk: There is a potential risk that sensitive information, such as hardcoded secrets in a diff or internal security vulnerabilities identified in the 'Threat Model' or 'Security Notes' sections (defined in subskills/notion-spec-generator.md), could be exfiltrated to a Notion workspace during the publishing step.

architecture-spec