The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructions direct the agent to scan sensitive locations and files, including the full working tree, git history, and environment configuration files (.env). It specifically targets high-value credential patterns like AWS access keys (AKIA), Stripe secret keys (sk_), and database URLs. Although the skill mandates redaction (last 4 characters only) and forbids printing full secret values, the underlying capability to access and process these sensitive paths is flagged as data exposure.
[PROMPT_INJECTION]: The skill ingests untrusted data from the local repository and git history to perform its audit. This creates a surface for indirect prompt injection, where malicious instructions hidden in the audited codebase or commit messages could attempt to manipulate the agent's behavior. * Ingestion points: The skill scans the full working tree and complete git history for patterns. * Boundary markers: The skill contains explicit instructions to remain 'plan-only' and forbids automated rotation, scrubbing, or environment edits without prior approval. * Capability inventory: The skill utilizes file system read access to perform pattern scans across the repository and historical commits. * Sanitization: The skill explicitly requires redacting secret values in its output, showing only the type, location, and the last 4 characters of any found keys.

plan-secrets-audit