The Agent Skills Directory

[DATA_EXFILTRATION]: The skill implements an automated credential discovery mechanism that scans sensitive local files and environment variables. Evidence: In DX-AUDIT.md, the agent is instructed to search for API keys and tokens within shell configuration files including ~/.zshrc, ~/.bashrc, ~/.bash_profile, and ~/.zprofile, as well as environment files like .env and .envrc using grep commands. Evidence: The skill utilizes printenv to harvest keys from the current shell environment. Evidence: The skill attempts to retrieve credentials from the macOS Keychain using the security find-generic-password command.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, such as production transcripts and real user traffic, which can contain malicious instructions intended to influence agent behavior. Ingestion points: Real conversation transcripts and support tickets are used as primary data sources for testing and evaluation (HARNESS.md, FIX-LOOP.md). Boundary markers: The skill includes specific examples of how to handle injection attempts, such as ignoring commands like "Ignore previous instructions" when they appear in untrusted transcripts (HARNESS.md). Capability inventory: The orchestration logic has the capability to execute shell commands, manage network requests via curl, and spawn sub-agents, which increases the risk if an injection is successful (DX-AUDIT.md). Sanitization: Instructions are provided to redact secrets from traces and escape HTML content in generated reports (DX-AUDIT.md, GATES.md).
[PROMPT_INJECTION]: A static detection triggered a warning for prompt injection, which was determined to be a false positive. Evidence: The phrase "Ignore previous instructions" in HARNESS.md is part of an educational example describing how the agent should ignore malicious content found in data, rather than being an injection attempt itself.

agent-evals