The Agent Skills Directory

[DATA_EXPOSURE]: The skill is instructed to read sensitive configuration files including .env and .gitignore. This is performed specifically to audit security best practices, such as ensuring live API keys are not used in test environments and that secrets are correctly ignored by version control. The instructions explicitly forbid the agent from echoing secret values back to the user, mitigating exposure risk.
[INDIRECT_PROMPT_INJECTION]: The skill ingests various untrusted data sources including project documentation (PAGOKIT_INTEGRATION.md), environment files, database schemas, and source code files.
Ingestion points: Files like PAGOKIT_INTEGRATION.md, .env, schema files (Prisma, SQLAlchemy, etc.), and webhook handler source code.
Boundary markers: None identified in the prompt instructions.
Capability inventory: Limited to Read, Glob, Grep, and restricted shell commands (ls, test). No network or file-write capabilities are available.
Sanitization: No explicit sanitization or filtering of external content is mentioned. While this creates a surface for indirect prompt injection, the skill's restricted toolset and read-only nature significantly limit the impact.

doctor