The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is explicitly designed to discover and analyze sensitive files, specifically targeting .env files in the project directory. While the stated goal is to check if these files are properly excluded from version control via .gitignore, the scripts/discover_env.py script and the agent instructions in SKILL.md involve direct access and reporting on the presence of secrets.
[DATA_EXFILTRATION]: The file scan_results.json contains an absolute local filesystem path (/Users/corneliusgeorge/amair/package.json) from the author's development environment, which exposes information about the vendor's internal directory structure.
[COMMAND_EXECUTION]: The scripts/generate_report.py script generates shell commands (e.g., npm install) and Python test code that utilizes subprocess.run(). These commands are constructed via string interpolation using package names and version strings sourced from local dependency files (like package.json) and the OSV.dev API. A lack of sanitization at these points creates a vulnerability to command injection if a malicious actor names a package with shell metacharacters.
[EXTERNAL_DOWNLOADS]: The scripts/fetch_vulns.py script performs network requests to https://api.osv.dev/v1/query. This is used to retrieve vulnerability information from a well-known service provided by Google.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection due to the way it processes external data.
Ingestion points: Project configuration files (e.g., package.json, requirements.txt) and JSON responses from the OSV.dev API are read and parsed by the discovery and fetch scripts.
Boundary markers: The generated reports and validation tests do not use strict boundary markers or sanitization to distinguish between trusted instructions and untrusted data from these sources.
Capability inventory: The skill uses the Write and Edit tools to generate executable scripts and instructions, and provides commands intended for the Bash tool.
Sanitization: There is no evidence of escaping or validating the content of package names or version strings before they are interpolated into commands and script templates.

security-analyzer