The Agent Skills Directory

[CREDENTIALS_UNSAFE]: Hardcoded credentials and connection strings are present in the demonstration files within the assets directory. While these are documented as intentional examples for detection training, they represent a credential exposure pattern.
File assets/sample_codebase/src/user_service.py contains a hardcoded DATABASE_URL with a password and a mock API_KEY.
File assets/sample_codebase/src/frontend.js contains a hardcoded mock API_KEY and stores an authToken in local storage.
File assets/sample_codebase/src/payment_processor.py contains hardcoded mock test keys for Stripe, PayPal, and Square.
[INDIRECT_PROMPT_INJECTION]: The debt_scanner.py tool generates reports based on untrusted file content, such as code comments, which could be used to influence an agent's context if the report is ingested without proper boundaries.
Ingestion points: The debt_scanner.py script reads arbitrary code and comment content from user-specified directories (e.g., in _scan_file and _scan_common_patterns).
Boundary markers: Absent. The scanner output is a list of descriptions derived directly from the source code.
Capability inventory: The core tools (debt_scanner.py, debt_prioritizer.py, debt_dashboard.py) perform file system read/write operations for analysis and reporting but do not possess high-risk capabilities like shell command execution or network exfiltration.
Sanitization: The scanner extracts text using regex patterns but does not sanitize, escape, or filter the extracted content before including it in the final JSON or text reports.

tech-debt-tracker