The Agent Skills Directory

[DATA_EXFILTRATION]: Reads the local configuration file ~/.qodo/config.json to retrieve an API key (API_KEY) and environment settings. This information is used to authenticate requests to the Qodo platform API. This pattern involves reading a tool-specific credential file and transmitting the token to the service's official API endpoints.
[EXTERNAL_DOWNLOADS]: Fetches rules from external endpoints at qodo.ai via a paginated API. The base URL is constructed dynamically from configuration settings (e.g., https://qodo-platform.staging.qodo.ai/rules/v1).
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting "rules" from an external API and instructing the agent to treat them as mandatory constraints for code generation tasks.
Ingestion points: API response data from {API_URL}/rules as described in references/pagination.md.
Boundary markers: The output is formatted with markdown headers (e.g., ## ❌ ERROR Rules (Must Comply)) in references/output-format.md, but it lacks explicit "ignore embedded instructions" warnings for the content of the rules themselves.
Capability inventory: The skill uses the Bash tool to interact with the local filesystem and git environment to determine repository scope.
Sanitization: There is no evidence of sanitization or validation of the rule descriptions and names fetched from the external API before they are presented to the agent's context.

get-qodo-rules