The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources and lacks proper boundary markers or sanitization to prevent adversarial instructions from influencing agent behavior.
Ingestion points: The system consumes data from local file systems via the user-provided Docs path and from the public internet via the URL parameter and WebSearch tool (as described in SKILL.md and references/agent-prompts.md).
Boundary markers: The specialist agent prompts in references/agent-prompts.md interpolate variables like {context_brief}, {agent_1_findings_if_available}, and {agent_2_findings_if_available} directly into the instructions. There are no delimiters (e.g., XML tags, triple quotes) or specific "ignore embedded instructions" warnings used when processing this external data.
Capability inventory: The skill has broad capabilities including Bash, Write, WebSearch, and the ability to spawn sub-agents (Agent). These tools could be misused if an indirect injection attack succeeds.
Sanitization: The files do not contain logic for validating, escaping, or filtering content retrieved from external documents or URLs before it is processed by the LLM.
[COMMAND_EXECUTION]: The specialist agents are granted access to the Bash tool and are explicitly encouraged to analyze scripts and build files, which provides a pathway for code execution.
The Agent 1 and Agent 2 prompts in references/agent-prompts.md instruct the agents to scan for and "examine" Makefiles, shell scripts in scripts/ or bin/ directories, and CI/CD configurations like .github/workflows/. While the stated goal is auditing, the availability of the Bash tool allows the agent to execute these files, which is a risk if the files are malicious.
[DATA_EXFILTRATION]: The skill is designed to discover and inventory sensitive technical information, creating a significant risk of data exposure.
The Tech Stack Mapper agent is explicitly instructed to search for "API keys in configs", "Connection strings", and "OAuth configs" (documented in references/agent-prompts.md).
Although SKILL.md includes a guardrail stating "Never include the Supabase token or any credentials in the report," the act of searching for and processing these secrets increases the likelihood of accidental exposure or exfiltration if the agent is compromised via prompt injection.
The explicit mention of a "Supabase token" in the guardrails potentially alerts a compromised or malicious agent to the presence of specific high-value credentials in the execution environment.

multi-agent-client-onboarding