The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill's 'Context Aggregation' directive requires the agent to read the last 10 commands from the user's bash history. Bash history files are a primary source of sensitive data, often containing hardcoded credentials (e.g., database passwords, cloud provider tokens, and API keys) used in CLI operations.
[DATA_EXFILTRATION]: The skill automatically aggregates sensitive local information, including git diff outputs and the contents of all open files in the IDE. While no specific network exfiltration command is present in the skill text, these instructions direct the agent to harvest and process sensitive local data into its context.
[INDIRECT_PROMPT_INJECTION]: The skill lacks security controls for handling untrusted data ingested from the codebase.
Ingestion points: Aggregation of git diff and open files (SKILL.md, Core Directive 1).
Boundary markers: Absent. The instructions do not specify any delimiters or directives to treat the aggregated content as untrusted data.
Capability inventory: The skill uses file system access and shell history retrieval.
Sanitization: Absent. There is no mention of escaping, filtering, or validating the content retrieved from the development environment before it is processed by the agent.

future-predictor