The Agent Skills Directory

Architectural Data Extraction: The skill identifies services, ports, and API endpoints by scanning project files such as pom.xml, docker-compose.yml, and application.properties. This process extracts metadata necessary for architectural mapping and does not involve remote network calls or credential exfiltration.
Indirect Prompt Injection Surface: The skill ingests untrusted data by analyzing project source code. (1) Ingestion points: The agent reads various source files and configuration documents (Step 1-6). (2) Boundary markers: No explicit instructions are provided to the agent to distinguish between its own logic and instructions that might be embedded in the analyzed code. (3) Capability inventory: The skill is limited to reading local files and writing a markdown report (Step 8). (4) Sanitization: There are no specific mechanisms defined for escaping or validating the content of the analyzed files. While this creates a potential surface for indirect prompt injection, it is a standard consideration for analysis tools and is mitigated by the skill's defined output structure.
Local File Operations: The skill writes its generated report to the .github/modernize/assessment/ directory. This is a standard practice for creating project-internal documentation and assessment facts.

api-service-contracts