The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a Python report-building script using direct shell interpolation of the $system variable: python3 "${ANTIGRAVITY_PLUGIN_ROOT}/scripts/build_report.py" $system. Because the variable is inserted without sanitization or quoting, a malicious input containing shell metacharacters (e.g., ;, &&, or |) could lead to arbitrary command execution on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and summarizes content from numerous external project artifacts, which could allow malicious instructions embedded in those files to influence the agent's behavior.
Ingestion points: The skill reads several files including INTENT.md, PREFLIGHT.md, ASSESSMENT.md, BUSINESS_RULES.md, RULE_REVIEWS.json, MODERNIZATION_BRIEF.md, EQUIVALENCE.json, and VERIFICATION.md located in the analysis/ and modernized/ directories.
Boundary markers: The instructions lack delimiters or specific warnings to prevent the agent from inadvertently executing instructions found within the data of these project files.
Capability inventory: The skill has capabilities for shell command execution (Python script), Git operations (git check-ignore, git ls-files, git log), and broad read access to the local filesystem.
Sanitization: There is no evidence of validation, sanitization, or escaping of the content ingested from the external files before it is processed by the agent.
[DATA_EXFILTRATION]: The skill is explicitly instructed to locate and inspect sensitive file paths, including SECRETS.local.md and *.local.patch. While intended for 'Secrets hygiene' (ensuring they are not tracked in Git), the practice of an AI agent programmatically targeting and reading files that contain raw credentials increases the risk of accidental exposure or exfiltration if the agent's output is captured in logs or transmitted over a network.

modernize-status