The Agent Skills Directory

[DATA_EXFILTRATION]: The skill directs the agent to access the local Gradle cache located at ~/.gradle/caches/modules-2. While this is a standard location for build artifacts in a development environment, it is a sensitive directory that contains proprietary or third-party compiled code, which the agent would not typically need to access.
[COMMAND_EXECUTION]: The instructions include complex shell command chains that perform directory creation (mktemp), file extraction (unzip), and binary inspection (javap) on local artifacts. These operations allow the agent to manipulate and read data from the local filesystem outside of the immediate project scope.
[INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface by ingesting and processing untrusted data (local Kotlin source files and binary JAR artifacts) using shell tools without explicit sanitization or validation of the file contents before parsing.
Ingestion points: Project-level Kotlin files (*.kt) and binary JAR files discovered in the ~/.gradle/caches directory.
Boundary markers: Absent. The commands process raw file content directly, relying on pattern matching to extract information.
Capability inventory: File system read access, temporary directory creation, ZIP archive extraction, and binary bytecode inspection via javap.
Sanitization: Absent. The audit logic uses grep, sed, and awk to parse output, which could be bypassed or manipulated by specially crafted strings inside the files being audited.

restricted-marker-is-not-an-opt-in