The Agent Skills Directory

[DATA_EXFILTRATION]: The skill provides template prompts that instruct the agent to access sensitive file paths. Specifically, under 'Launch parallel explore agents', the instructions suggest using Task 3 to 'Check .github/, docker*, .config., .env*.' to report on environment variable management. Accessing .env files is a high-risk activity as these files frequently contain plaintext API keys, database credentials, and other secrets that could be exposed in the agent's context and conversation history.
[INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for ingesting and synthesizing information from external, potentially untrusted codebases, which presents an attack surface for indirect prompt injection.
Ingestion points: The skill utilizes the explore subagent to read and analyze files throughout an entire codebase based on the provided directory patterns (e.g., src/app/, src/server/, lib/).
Boundary markers: There are no instructions or system prompts provided to the subagents to ignore or delimit potentially malicious instructions embedded within the source code (e.g., in markdown documentation, code comments, or string literals) being explored.
Capability inventory: The subagents are described as read-only; however, the main agent synthesizes the results, and the main agent often has broader capabilities including file writing and network operations.
Sanitization: The skill does not implement any sanitization, filtering, or validation of the content read from the codebase before it is summarized and processed by the agent.

parallel-exploring