The Agent Skills Directory

[SAFE]: The skill is a well-designed administrative tool for software security design. It operates entirely within the local repository context, using local templates and reference documents. The instructions provided to the agent focus on identifying architectural threats and proposing mitigations without requesting elevated privileges or external network access.
[INDIRECT_PROMPT_INJECTION]: The skill involves reading various repository files (such as READMEs and source code) to map system architecture. While reading untrusted project content creates a surface for indirect prompt injection, this is inherent to the skill's primary purpose as an analysis tool. The skill minimizes risk by focusing on design-level analysis and structured output in the docs/security/ directory.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill includes explicit safeguards against data exposure, instructing the agent to never copy secrets or identity values discovered during exploration into the threat model, and instead providing a mechanism to notify the user separately if secrets are encountered.

threat-modeling