The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the user's codebase to generate summaries and documentation, creating a potential surface for indirect prompt injection.
Ingestion points: The agent is instructed to "Read the project root" and scan all source files, directories, and configuration files (SKILL.md, Step 1).
Boundary markers: There are no explicit instructions to use delimiters or ignore embedded instructions when reading source code files.
Capability inventory: The skill allows the agent to write multiple markdown files to the docs/ directory at the project root.
Sanitization: While instructions advise not to copy-paste code directly, there is no technical sanitization or filtering of content ingested from the codebase.
[CREDENTIALS_UNSAFE]: The skill instructions and templates suggest identifying and documenting configuration parameters from potentially sensitive files.
Evidence: The CONFIGURATION.md template in references/doc-templates.md specifically lists .env files and environment variables like DATABASE_URL and JWT_SECRET as items to be documented. While intended as a mapping of configuration keys, an agent might inadvertently include real values from the environment or .env file if not properly constrained.

codebase-docs