The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute build-related commands and compilers based on the detected stack in the legacy code. This includes running tools like make, maven, gcc, and dotnet on files found within the user-provided repository path (legacy/$system). This poses a risk as the build configuration files (e.g., Makefile, pom.xml) could contain malicious instructions that are executed during the restoration or smoke-testing phases.
[DATA_EXPOSURE]: The skill accesses sensitive user and project configuration files, including ~/.agents/settings.json, .claude/settings.local.json, and files within CLAUDE_CONFIG_DIR. While the instructions explicitly state not to quote credentials found in these files, the act of reading these locations is an exposure risk.
[DYNAMIC_EXECUTION]: As part of Check 3b, the skill creates a temporary project in a scratch directory to verify a target stack. This involves using package managers to restore dependencies and execute tests, which can result in the execution of third-party code retrieved from external registries.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection as it ingests and processes untrusted data from the source code repository, including CI/pipeline definitions (azure-pipelines.yml, Jenkinsfile) and configuration files.
Ingestion points: Reads contents of legacy/$system and various CI/build configuration files.
Boundary markers: None implemented to distinguish between the analyzed data and system instructions.
Capability inventory: The skill uses run_command, write_to_file, mkdir, and ln, providing a mechanism for injected instructions to perform actions in the environment.
Sanitization: There is no evidence of sanitization for the content read from the source repository before it is processed by the agent.

modernize-preflight