The Agent Skills Directory

[PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data, specifically source code and documentation from a target project, which creates a surface for indirect prompt injection.
Ingestion points: The agent is instructed to read multiple local files, including README.md, ARCHITECTURE.md, SECURITY.md, source code (*.py, *.ts, *.go, etc.), and configuration files (.env, package.json, Cargo.toml).
Boundary markers: There are no explicit instructions or delimiters provided to the agent to treat the content of these external files as untrusted or to ignore embedded instructions.
Capability inventory: The skill utilizes powerful shell capabilities (ls, grep, find, cat, curl, tree, git) and suggests the use of various external analysis tools.
Sanitization: The skill does not mention or implement any filtering, escaping, or sanitization of the content retrieved from the target codebase before processing it.
[DATA_EXFILTRATION]: The skill contains commands and instructions for searching and accessing sensitive system and configuration paths.
Evidence: Instructions in SKILL.md and resources/recon-checklist.md direct the agent to search for sensitive files such as ~/.aws/credentials, ~/.aws/config, ~/.ssh/id_rsa, .env, and strings like password, secret, api_key, and private key headers (-----BEGIN). While this is the intended purpose of a security audit skill, it grants the agent access to highly sensitive information.
[EXTERNAL_DOWNLOADS]: The skill documentation includes commands that download data from external sources and suggests the installation of numerous third-party tools.
Evidence: SKILL.md and docs/advanced-techniques.md mention using curl to fetch OpenAPI schemas (/openapi.json) and using package managers like npm and pip to install or audit dependencies. These are standard diagnostic practices for the intended use-case.

code-recon