The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructions direct the agent to scan sensitive file paths including ~/.claude/mcp_config*.json, ~/.codeium/windsurf/mcp_config*.json, and ~/.config/devin/mcp_config*.json. These files are standard locations for storing API keys, session tokens, and environment-specific secrets.
[DATA_EXFILTRATION]: The skill aggregates data from multiple IDE configuration files into a centralized Knowledge Graph via the graph_ingest tool. If the epistemic-graph orchestration backend is remote or has broader access, this creates a significant credential exposure risk.
[COMMAND_EXECUTION]: Through the graph_orchestrate tool, the skill executes shell commands using command, args, and env parameters retrieved from the Knowledge Graph. Because the graph is populated by ingesting local configuration files, this enables arbitrary command execution if an attacker can influence the contents of the scanned configuration files.
[PROMPT_INJECTION]: The skill processes untrusted configuration files and uses their contents to determine which commands to execute, creating a vulnerability to indirect injection. Ingestion points: SKILL.md (Step 2) identifies multiple config paths for ingestion. Boundary markers: None are specified to separate configuration data from executable instructions. Capability inventory: Includes graph querying, file ingestion, and agent execution (subprocess spawning). Sanitization: No evidence of validation or sanitization of the command or args strings before they are used for process execution.

kg-delegation-router