The Agent Skills Directory

[METADATA_POISONING]: There is a discrepancy between the author identified in the skill's frontmatter and JSON metadata (sickn33) and the author provided in the analysis context (diegosouzapw). This inconsistency in provenance information can be deceptive regarding the true origin and maintenance responsibility of the skill.
[CREDENTIALS_UNSAFE]: The skill instructions explicitly direct the agent to locate and read sensitive files, including .env files, private keys (*.pem, *.key), and files containing strings like api_key, password, or token. While the goal is to prevent these from being committed, the workflow requires the agent to access and process the raw content of these secrets.
[INDIRECT_PROMPT_INJECTION]: The skill processes an entire codebase as input, creating a large ingestion surface for untrusted data.
Ingestion points: The audit workflow mandates that the agent "Audit Every Source File" and read every line of the repository.
Boundary markers: No delimiters or specific safety instructions are provided to prevent the agent from executing instructions that may be embedded within the source code being audited.
Capability inventory: The agent is granted autonomous capabilities to "Delete these immediately" and "Fix problems as you find them", providing an exploitable path for malicious code to trigger destructive actions or logic changes.
Sanitization: No sanitization of the audited files is performed before the agent acts on the content.
[COMMAND_EXECUTION]: The workflow mandates autonomous file system operations. It directs the agent to immediately delete numerous categories of files and directly refactor or rename source code variables without a mandatory human-in-the-loop confirmation for each individual action, increasing the risk of unintended data loss or unauthorized modifications.

codebase-audit-pre-push