The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill implements an automated "auto-discovery" workflow for credentials that explicitly targets sensitive system files and stores. In ONBOARDING-AUDIT.md, it defines tiers for secret discovery, including scanning shell profile files (~/.zshrc, ~/.bashrc, ~/.bash_profile, ~/.zprofile) and environment files (.env, .envrc) using grep.
[CREDENTIALS_UNSAFE]: The skill attempts to programmatically interface with external password managers and system secret stores. It includes commands to check 1Password via 'op account list' and search the macOS Keychain using 'security find-generic-password'.
[DATA_EXFILTRATION]: The orchestration logic maintains real-named credentials to "verify claims" by making network requests (e.g., via curl). This creates a path where sensitive discovered secrets are processed and potentially transmitted beyond the immediate local workspace.
[COMMAND_EXECUTION]: The skill relies on 'Allow Bash' mode to execute shell commands for both credential harvesting and audit execution. It instructions the agent to run complex pipeline commands like 'printenv | grep -iE ...' to extract tokens and keys from the environment.
[PRIVILEGE_ESCALATION]: Accessing the macOS Keychain and system-level shell configuration files represents an attempt to acquire information and access rights beyond the standard requirements of a documentation audit tool.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data, including documentation, SDKs, and third-party SKILL.md files. This introduces an attack surface where malicious instructions embedded in the audited material could influence the behavior of the subagents.
Ingestion points: Third-party product documentation, SDK source code, and external SKILL.md files fetched during the audit (ONBOARDING-AUDIT.md).
Boundary markers: None identified; there are no explicit instructions or delimiters used to ensure subagents ignore instructions found within the audited content.
Capability inventory: Subagents have access to Bash execution, network operations (curl), and file system access within the current folder.
Sanitization: No evidence of sanitization, escaping, or validation of the fetched external content before it is processed by subagents.

agent-dx-audit