The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection. 1. Ingestion points: Phases 1, 3, 5, and 6 involve reading codebase files, .env, .gitignore, and git log output (SKILL.md). 2. Boundary markers: Includes specific 'Anti-hallucination guidelines' and instructions to never echo found secrets. 3. Capability inventory: Employs grep, git, and gitleaks for file system and history access. No dangerous sinks like eval or arbitrary file writes are used. 4. Sanitization: Uses grep -o and cut to extract only specific patterns (keys), preventing the ingestion of potentially malicious surrounding text.
[COMMAND_EXECUTION]: The skill executes local shell commands including grep, git, and gitleaks. These are used for their intended purpose of scanning files and history. The patterns are statically defined in the reference files, reducing the risk of command injection from user input.
[DATA_EXFILTRATION]: The skill accesses the .env file, which is a sensitive file path typically containing credentials. This is categorized as data exposure. However, the skill includes rigorous instructions to only extract and report variable keys (using cut) and uses gitleaks --redact to ensure actual secret values are not exposed in the agent's output context. No network-based exfiltration paths were identified.

env-setup