The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to read and process content from external, untrusted Gitee repositories (such as README files, source code, and configuration files). This creates an attack surface where a malicious repository could contain hidden instructions intended to influence or manipulate the agent's behavior.
Ingestion points: The skill uses get_file_content to read files like README.md, package.json, go.mod, and other source files in SKILL.md.
Boundary markers: None present; the instructions do not specify the use of delimiters or provide warnings to ignore embedded instructions within repository content.
Capability inventory: Access to tools get_file_content, search_files_by_content, and list_user_repos via the Gitee MCP server.
Sanitization: No sanitization or validation of the ingested repository content is mentioned.
[DATA_EXFILTRATION]: The skill instructions guide the agent to identify and read files or code sections that typically contain sensitive information.
Evidence: In Step 5, the skill explicitly suggests performing targeted searches for keywords like auth, token, permission, config, env, and ENV. While intended for architectural understanding, this pattern could lead to the exposure of sensitive credentials or environment secrets if they are present in the repository being analyzed.

repo-explorer