The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it is designed to read and analyze repository content via the explorer subagent (as defined in references/code-exploration.md).
Ingestion points: System files and repository code read by the explorer subagent.
Boundary markers: The subagent is explicitly instructed in subagents/explorer-prompt.md to return only a 'brief structured report' and to avoid returning file dumps or long quotes.
Capability inventory: The orchestrator utilizes a read-only subagent to gather context; it does not have write access to the filesystem by design (enforced in SKILL.md with the rule 'ЗАПРЕЩЕНО менять файлы').
Sanitization: The explorer-prompt.md acts as a filter, instructing the agent to distinguish between observed facts, conclusions, and assumptions while ignoring implementation suggestions within the source code.
[COMMAND_EXECUTION]: While the skill orchestrates code analysis, it explicitly restricts tools to read-only operations. The debug workflow in workflows/debug.md defines safety limits, forbidding the execution of migrations, database writes, or administrative actions, ensuring the agent remains within a non-destructive scope.
[SAFE]: The project uses a clear separation of concerns (orchestrator vs. explorer subagent) and defines model tiers (references/subagent-model-tiers.md) for resource management. These are standard architectural patterns for AI agents and do not present a security risk.

bro-think-with-me