The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses sensitive configuration files, including .env and docker-compose.yml, to identify environment variable keys for its architecture maps.
Evidence: Found in SKILL.md (Layer 6 discovery) and SECURITY.md (SEC-01).
Mitigation: The skill implements strict redaction controls (SEC-01, SEC-09, SEC-15) to ensure that sensitive values are never written to the atlas, graph artifacts, or bug reports.
[PROMPT_INJECTION]: The skill has a surface area for indirect prompt injection because it ingests and analyzes untrusted source code and metadata from external repositories.
Ingestion points: Untrusted data enters the agent context via the codebase_path in SKILL.md when reading source files, READMEs, and configuration manifests.
Boundary markers: There are no explicit boundary markers or instructions to ignore embedded commands present in the reviewer or analyzer agent prompts defined in API-CONTRACTS.md.
Capability inventory: Exploitable capabilities include the ability to perform git push operations (SEC-19) and execute system commands for diagram rendering via subprocess.run (SEC-06).
Sanitization: Extensive sanitization controls (SEC-03, SEC-10, SEC-11, SEC-12) are applied to all diagram labels and bug report content to prevent injection at the output layer.
[COMMAND_EXECUTION]: The skill executes external visualization tools, such as dot (Graphviz) and mmdc (Mermaid CLI), to render diagram source files into SVGs.
Evidence: Documented in publication-guide.md (SVG Generation Commands) and SECURITY.md (SEC-06).
Mitigation: All command execution is performed using subprocess.run with argument arrays to prevent shell injection, and the use of shell=True is strictly forbidden by SEC-06.

code-atlas