The Agent Skills Directory

[DATA_EXFILTRATION]: The skill's ship stage automatically executes harness telemetry sync, which pushes telemetry data to the remote repository's git references (refs/harness-telemetry/*). This network operation occurs without a user confirmation gate, potentially exposing metadata to external hosts.
[CREDENTIALS_UNSAFE]: In references/stages/60-implement.md, the skill retrieves the user's GitHub authentication token via gh auth token and exports it as an environment variable (GH_TOKEN). This sensitive credential is subsequently shared with an unverified external tool named minih.
[EXTERNAL_DOWNLOADS]: The skill requires and invokes external software from sources not included in the trusted vendor list. It directs users to install the @ai-substrate/engineering-harness NPM package and the minih tool from a public GitHub repository, both of which are automatically executed as part of the skill's workflow.
[COMMAND_EXECUTION]: The skill frequently executes shell commands and CLI tools such as git, gh, harness, and minih. These commands are often constructed using variables derived from user input or project artifacts, which could be exploited for command injection if malicious content is introduced into the planning documents.
[PROMPT_INJECTION]: There is a high surface area for indirect prompt injection as the skill reads and processes content from numerous project files like research dossiers, implementation plans, and architectural records. These files, which could contain untrusted data, directly influence the agent's behavior and the construction of shell commands. The skill lacks robust sanitization or explicit boundary markers to prevent malicious instructions embedded in these files from being executed.

the-flow