The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill explicitly instructs the agent to access and inventory sensitive file paths and configurations. Specifically, in 'Step 2: Cross-Reference with System Inventory', the agent is directed to check for '.env files or config that reference existing services'. Environment files are a primary source for hardcoded API keys, database credentials, and secrets.
[DATA_EXFILTRATION]: The instructions mandate an inventory of 'Cloud CLIs (aws, gcloud, az, vercel, fly, railway, netlify)'. These CLI tools typically store authentication tokens and account configurations in plain text or standard configuration directories (e.g., ~/.aws/credentials). Accessing these paths creates a high risk of sensitive data exposure.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-provided project requirements and classification strings. Because the skill also has access to system inventory metadata, this creates an attack surface where malicious input could influence how the agent interprets or reports on the discovered system configurations.
Ingestion points: User-provided project requirements and architecture descriptions in SKILL.md.
Boundary markers: None present; user input is directly classified into requirement tiers.
Capability inventory: Access to system inventory (CLIs, ports, processes), environment variable access, and file reading of configuration files (.env, package.json).
Sanitization: No evidence of input sanitization or validation of the project requirement strings before processing.

deployment-advisor