The Agent Skills Directory

[DATA_EXFILTRATION]: The SESSION CLOSE PROTOCOL section in SKILL.md instructs the agent to execute git add . followed by git push. This sequence is dangerous as it can result in the unintended upload of sensitive files (such as .env, credentials, or temporary backups in .tmp/) to a remote repository. It also risks exfiltrating the bug-hunting-report.md and bug-fixes-implemented.md files, which may contain details of security vulnerabilities or hardcoded credentials found during the scan.
[PROMPT_INJECTION]: The skill processes untrusted data from the codebase to generate bug reports, creating an indirect prompt injection surface. Content from these reports is then used to create issues in the bd tool and as input prompts for the bug-fixer subagent.
Ingestion points: The skill reads bug-hunting-report.md in Phase 3, 5, and 6 to drive subsequent logic.
Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands when the bug descriptions are interpolated into subagent prompts or issue tracker commands.
Capability inventory: The skill can execute shell commands, invoke subagents with broad instructions, and interact with the bd issue tracking tool.
Sanitization: The skill does not validate or sanitize findings from the codebase before passing them to other agents or tools.
[COMMAND_EXECUTION]: The skill performs multiple shell operations including directory management (mkdir), build script execution (pnpm), and version control operations (git). These commands are performed in the user's workspace context and are triggered automatically by the workflow.

health-bugs