The Agent Skills Directory

[SAFE]: The skill includes a dedicated 'Sensitive-Files Guardrail' section that explicitly instructs the agent to skip reading files that typically contain secrets, such as environment files, PEM keys, and cloud provider credentials.
[SAFE]: The instructions emphasize a 'read-only' posture, ensuring the agent observes the codebase without mutating files, which prevents accidental or malicious code modification.
[SAFE]: A 'Post-exploration secret scan' phase is integrated into the workflow, utilizing shell commands (grep) to identify and redact potential API keys or passwords from the analysis output before it is displayed to the user.
[SAFE]: The Python scripts (cartographer.py, cartographer_omni.py, and cartographer_ultimate.py) use standard Python libraries to perform pattern matching and statistical measurement. They do not employ dynamic execution (eval/exec) or perform any network operations.
[SAFE]: All shell commands defined in the exploration phases (ls, find, grep, git log) are standard utilities used for information gathering within the project directory and do not involve data exfiltration to external domains.

codebase-overview