The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains explicit instructions to bypass AI safety guidelines. It directs the agent to route security audit passes away from specific models (Claude Fable 5.1) because their 'safety classifiers can refuse adversarial red-team phrasing'. It instructs the agent to use a fallback model to ensure the audit tasks are not blocked by standard safety protocols.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill is designed to search for and access highly sensitive data across the filesystem and project history.
It targets sensitive file extensions such as .env, .key, and .pem.
It executes commands to extract credentials from git history, specifically looking for AWS keys (AKIA), GitHub tokens (ghp_), and patterns matching private API keys and passwords.
It inspects the content of other installed plugins and skills located in ~/.claude/plugins/ and ~/.claude/skills/.
[COMMAND_EXECUTION]: The skill relies on the execution of local shell scripts and system commands to perform its functions. It invokes a primary orchestration script located at ${HOME}/.claude-octopus/plugin/scripts/orchestrate.sh and uses various shell utilities like find, grep, and git to analyze the environment.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection. It is designed to ingest and process untrusted data from the codebase, including git diffs, commit messages, CI/CD workflow files, and the source code of other skills.
Ingestion points: Git history (git log), workflow files (.github/workflows/*.yml), and other skill manifests (SKILL.md).
Boundary markers: No explicit delimiters or instructions to ignore embedded commands within the processed files are provided.
Capability inventory: The skill can execute shell commands via orchestrate.sh and search the filesystem.
Sanitization: There is no evidence of sanitization or validation of the content read from external files before it is processed by the agent.

octopus-security-audit