The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests issue descriptions and comments from Gitee, which are untrusted external inputs.
Ingestion points: Issue details and comments are retrieved via get_repo_issue_detail and list_comments in SKILL.md (Step 1).
Boundary markers: Absent. There are no instructions to use delimiters or ignore potentially malicious instructions within the issue content.
Capability inventory: The skill has extensive capabilities including file system access (glob, grep, read), shell command execution (bash), and AST-based searching.
Sanitization: Absent. The untrusted data is processed directly to identify code entities and generate fix plans.
[DATA_EXFILTRATION]: The skill documentation suggests patterns for locating sensitive configuration files which may lead to exposure.
Evidence: TOOL_REFERENCE.md includes a pattern to search for environment files: glob('**/.env*', { cwd: repoPath }).
Risk: Reading .env files can lead to the exposure of credentials or API keys if the agent includes their content in suggestions or sends it to the Gitee API during search fallbacks.
[COMMAND_EXECUTION]: The skill utilizes shell commands to gather repository metadata.
Evidence: TOOL_REFERENCE.md contains a template for using the bash tool to execute git log for analyzing recent changes.

quick-fix-suggestion