The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill explicitly instructs the agent to scan sensitive environment files (such as .env, .env.local, and .env.production) to locate and read API keys, specifically targeting LANGFUSE_SECRET_KEY. While the reasoning section advises against reporting the secret, the Grep command causes the secret value to be read into the agent's context, posing a significant exposure risk.
[UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill uses npx to dynamically download and execute external packages, including langfuse-cli and @playwright/cli. While Playwright is a well-known tool, the execution of unversioned packages from a public registry introduces remote code execution risks.
[DYNAMIC_EXECUTION]: The skill performs arbitrary SQL execution via supabase:execute_sql and executes shell commands to interact with external APIs and browser automation tools. These capabilities allow for high-privilege operations within the linked infrastructure.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a broad surface for indirect prompt injection because it processes data from several untrusted or external sources.
Ingestion points: Web scraping results from Firecrawl, LLM trace logs from Langfuse, browser console output from Playwright, and database records from Supabase.
Boundary markers: The skill lacks explicit boundary markers or instructions for the agent to ignore potentially malicious instructions embedded in the ingested data.
Capability inventory: The agent is empowered to execute shell commands, run SQL queries, and perform browser-based interactions, which could be abused if an injection is successful.
Sanitization: There is no mention of sanitization or validation of the content retrieved from external sources before it is processed or used in decision-making.

audit-langfuse-llm