The Agent Skills Directory

[SAFE]: The skill implements strong defensive measures against common AI agent risks.
[PROMPT_INJECTION]: The static detector flagged a potential override, but this is a false positive. The skill contains defensive instructions (Hard Rule 6) that explicitly tell the agent to treat repository content as data and ignore any embedded instructions (e.g., 'ignore previous instructions'). This is a security feature, not an injection.
[DATA_EXFILTRATION]: Hard Rule 4 explicitly prohibits the reproduction of secret values (tokens, credentials, .env contents). It instructs the agent to reference only the file/line and type, and to never include the actual value in its output. The audit playbook (references/audit-playbook.md) reinforces this during the security scan phase.
[COMMAND_EXECUTION]: The skill follows a 'read-only' posture for the host environment. Hard Rule 2 prohibits any commands that mutate the working tree (no installs, builds, or git commits). Allowed commands are scoped to read-only analysis tools like tsc --noEmit, linters, and npm audit. Execution of code changes is delegated to a separate executor subagent in an isolated git worktree, preventing direct impact on the user's primary environment.
[REMOTE_CODE_EXECUTION]: No remote code execution patterns were detected. The skill uses standard local ecosystem tools (npm/pypi audit) in read-only mode to check for dependency vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill uses gh (GitHub CLI) for issue creation, but only when authorized by an explicit --issues flag. It includes a specific check for repository visibility to prevent accidental public exposure of sensitive audit findings.
[CREDENTIALS_UNSAFE]: No hardcoded credentials were found. The skill is designed to find and report credentials in target codebases while ensuring they are not leaked into the generated plan files.

improve