The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted repositories which could contain malicious instructions designed to hijack the agent's behavior.
Ingestion points: Code, comments, docstrings, and README files within the target repository (SKILL.md, Phase 1).
Boundary markers: Includes a dedicated "Security boundary" section in SKILL.md instructing the agent to treat repository content as untrusted data, never instructions, and to ignore commands found within repository text.
Capability inventory: File system read access (to parse code), file system write access (to output documentation), and network access (to clone git repositories).
Sanitization: Explicitly instructs the agent to quote or drop raw HTML and to ignore instructions intended to change the scope or output location of the documentation.
[DATA_EXFILTRATION]: The skill is designed to analyze project configuration, which includes environment variable names, manifests, and sensitive file patterns like .env or secret stores.
Evidence: The skill instructions explicitly mention reading manifests, lockfiles, and configuration files (SKILL.md, Phase 2) and identifying secrets (SKILL.md, Phase 6). It includes a mitigation to report secrets via chat rather than writing them to the documentation set, but the access to these files represents a data exposure surface.
[COMMAND_EXECUTION]: Executes git clone to retrieve remote repositories from user-provided URLs.
Evidence: The skill specifies a "safe temporary clone" process that disables hooks, submodule recursion, and large-file fetching to prevent malicious code execution during the checkout process (references/source-and-graph.md).

awesome-code-docs