The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses sensitive local file paths including .env and .gitignore to verify payment credentials and security configurations. While the prompt contains instructions to avoid echoing secrets and the toolset lacks network capabilities, reading these files is a significant permission level.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from the user's project, which could be used to host malicious instructions.
Ingestion points: Files such as PAGOKIT_INTEGRATION.md, .env, and application source code files identified through Glob or Read operations.
Boundary markers: No specific delimiters or safety instructions are defined to separate the content of the files being read from the agent's instructions.
Capability inventory: The skill is restricted to read-only tools (Read, Glob, Grep) and metadata-specific Bash commands (ls, test, git ls-files). It does not have access to the network or the ability to write files.
Sanitization: No sanitization or validation logic is applied to the contents of the ingested project files before they are processed by the agent.

doctor