The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill is instructed to read sensitive files such as .env and .env.example to extract environment variables. While this is used to populate the ENVIRONMENT_VARIABLES section in the generated AGENTS.md, it involves accessing files that commonly contain secrets and sensitive configuration data.
[COMMAND_EXECUTION]: The skill executes formatting and linting commands extracted directly from the target project's package.json. The instructions state: "Run [format cmd] and [lint cmd] on the generated files only." This creates a risk where a malicious repository could define dangerous commands in these script keys that the agent would then execute.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by ingesting and re-broadcasting untrusted data from the project into documentation.
Ingestion points: Reads metadata and content from package.json, .env, git log, and various source files to fill placeholders.
Boundary markers: There are no explicit instructions to use boundary markers or "ignore embedded instructions" warnings when interpolating project data into the templates.
Capability inventory: The skill has Write and Edit permissions for the filesystem, and Bash execution capabilities for project scripts and git operations.
Sanitization: The skill's verification step only scans for unfinished placeholders (e.g., {{) and does not sanitize the content of the ingested data for malicious instructions.

agents-generator