The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill's 'Codebase Discovery Guide' (references/codebase-discovery.md) instructs the agent to investigate 'Secrets management' and explicitly lists '.env patterns' as an area to check. This encourages the agent to access sensitive configuration files that typically contain hardcoded credentials, API keys, and private tokens.
[DATA_EXFILTRATION]: By directing the agent to catalog and analyze sensitive project files such as .env, the skill creates a high risk of data exposure. Sensitive information found in these files could be inadvertently included in the generated PRD or exposed within the agent's interaction history.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its automated codebase analysis.
Ingestion points: The agent is instructed to read various project configuration and script files (e.g., package.json, pyproject.toml, Makefile, Cargo.toml) during Phase 1 (Discovery) to identify project conventions and commands.
Boundary markers: There are no explicit instructions or delimiters provided to ensure the agent ignores or sanitizes malicious instructions that might be embedded in the files it reads.
Capability inventory: The skill utilizes file-reading capabilities for discovery and file-writing capabilities to generate the PRD at plans/<name>/prd.md.
Sanitization: The instructions lack a verification or sanitization step for discovered script commands before they are incorporated into the 'Quality Gates' section of the PRD, potentially allowing an attacker to inject malicious commands into the project's documentation via a compromised configuration file.

create-a-prd