The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to execute system commands including git operations (add, commit, checkout), running test suites, executing type checkers (tsc --noEmit), and running linters. While these are intended for refactoring safety, they provide a powerful capability that could be abused if the agent is subverted.
[INDIRECT_PROMPT_INJECTION]: The skill has a defined attack surface for indirect prompt injection as it ingests untrusted data from the codebase being refactored.
Ingestion points: The agent reads source code files during 'Step 2: Discovery Analysis' and 'Step 3: Targeted Assessment' using Glob, Grep, and Read tools.
Boundary markers: Absent. The instructions do not specify the use of delimiters or 'ignore' instructions when reading external file content into the agent context.
Capability inventory: The skill utilizes Bash (shell access), Edit/Write (file system modification), and Agent (subagent creation) tools, which could be exploited if malicious instructions are embedded in the code being analyzed.
Sanitization: Absent. There is no mention of sanitizing or validating the content of the files read before the agent processes them as instructions or data.
[DATA_EXFILTRATION]: The skill is instructed to read various configuration files such as .fullstack-dev/config.json and .mcp.json. While the skill identifies these for project setup, the ability to read arbitrary files and access the shell presents a risk of sensitive data exposure if the agent is misdirected to target files like .env (though .env is listed as a manual exclusion in discovery mode).

refactor