The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructions direct the agent to access and analyze highly sensitive files in the project repository as part of its exploration phase.
The agent is specifically told to read config/master.key and config/credentials.yml.enc. In Rails projects, the master.key is the primary secret used to decrypt all other application credentials.
The instructions also prompt the agent to read environment variable configuration files such as .env.example and .env.sample to document project settings.
Accessing these sensitive files exposes project-level secrets to the AI model, creating a high-risk data exposure scenario.
[INDIRECT_PROMPT_INJECTION]: The skill ingests the entire codebase to perform its function, which creates a significant surface for indirect prompt injection attacks.
Ingestion points: The agent is instructed to read any file in the root directory, source code files, and configuration files throughout the project.
Boundary markers: There are no delimiters or specific instructions for the agent to ignore potentially malicious instructions embedded within the files it is reading.
Capability inventory: The agent has the ability to read all files in the workspace and write content to README.md.
Sanitization: The skill lacks any mechanism to sanitize or validate the content it extracts from the codebase before processing it.

readme