The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill explicitly categorizes the env command as a "safe" read-only operation. In development and production environments, environment variables frequently contain sensitive API keys, database credentials, and other secrets that would be exposed to the agent context.
[DATA_EXFILTRATION]: The skill permits the use of curl -s for GET requests. While scoped to read-only operations, the combination of the Bash tool and network access provides a technical path for transmitting sensitive data gathered during the audit to external domains.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and report on untrusted data from a codebase or system state, creating a vulnerability surface where malicious instructions embedded in files could influence the agent.
Ingestion points: The agent uses Read, Bash, Grep, and Glob tools to read arbitrary file content and command output from the system (SKILL.md).
Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings when processing or reporting file content.
Capability inventory: The skill has access to the Bash tool, which allows for complex shell command execution and network operations via curl.
Sanitization: There are no instructions provided for sanitizing or escaping the external content before it is processed or included in the final report.

read-only-ops