The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes shell scripts (scripts/render.sh and scripts/verify-findings.sh) used for generating visual diagrams from Mermaid files and verifying that file path citations in the audit report are valid. These scripts perform local operations and do not execute untrusted external code.
[DATA_EXFILTRATION]: The workflow involves scanning the repository for environment variable identifiers (process.env.VAR_NAME) and configuration keys to identify 'unsurfaced configuration.' While this involves reading through configuration-related code, the data collection is limited to identifier names for auditing purposes rather than extracting secret values.
[COMMAND_EXECUTION]: The script scripts/verify-findings.sh uses a Python heredoc to dynamically execute a parsing script that extracts citations from generated audit reports. This is a contained utility function with no external input dependencies.
[PROMPT_INJECTION]: The skill instructs its agents to scan code comments (TODO, FIXME) as high-signal markers for potential code drift. This creates an indirect prompt injection surface where instructions placed in code comments within a scanned repository could theoretically be interpreted by the sub-agents, though the risk is localized to the auditing process.

wiring-audit