The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill has a broad attack surface as it ingests untrusted data from the local codebase to plan and implement event tracking.
Ingestion points: The skill reads directory structures and source file contents (package.json, logic files, etc.) in Steps 1 and 5 of SKILL.md to determine the framework and tracking plan.
Boundary markers: Absent. The instructions do not specify delimiters or warnings to ignore potential instructions embedded in the analyzed code.
Capability inventory: The skill executes package installation commands (Step 3) and performs file writes across the codebase to initialize SDKs and add tracking calls (Steps 4, 6, 7, 8, and 9).
Sanitization: Absent. There is no explicit sanitization of codebase content before it is used to generate implementation steps.
[CREDENTIALS_UNSAFE]: A hardcoded PostHog project token was detected in an example configuration file within the reference documentation.
Evidence: In references/EXAMPLE-swift.md, the example Xcode scheme file BurritoConsiderationClient.xcodeproj/xcshareddata/xcschemes/BurritoConsiderationClient.xcscheme contains a POSTHOG_PROJECT_TOKEN with the value phc_jE9kXU0depRekiuabVROlxxkIXn95NqsNO3qB4qNKtl.
Context: PostHog project tokens (starting with phc_) are public ingestion-only keys intended to be included in client-side binaries. As this token belongs to the vendor's demo application, it does not constitute a genuine security risk to the user's environment.

instrument-product-analytics