The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill's evaluation directory contains files with hardcoded realistic credentials that are explicitly described as live tokens in the metadata.
deploy/prod-values.yaml: Contains token: "acme_live_2f8d41b09ce74a7f9db35c1e". The associated criteria.json confirms this is intended to represent a live production token injected into a production environment.
security/gate-probe/probe.js: Contains const NORTHWIND_TOKEN = "nw_live_8c41f0a9d7e24b6ab0f3";.
src/integrations/acme/client.js: Contains const ACME_TOKEN = process.env.ACME_TOKEN || 'acme_live_2f8d41b09ce74a7f9db35c1e';.
[INDIRECT_PROMPT_INJECTION]: The evals/ directory contains high-complexity instructional data that could influence agent behavior if processed as context.
Ingestion points: Multiple task.md and criteria.json files within the evals/ subdirectories.
Boundary markers: Absent. The complex narratives describing expected agent failures and reasoning paths are not delimited to prevent the agent from adopting them as authoritative instructions.
Capability inventory: The skill documents and triggers shell commands (semgrep ci, semgrep scan, npm test) and performs extensive file system operations.
Sanitization: No explicit validation or escaping is applied to the data processed from the evaluation files.
[COMMAND_EXECUTION]: The skill relies on executing shell commands for its core functionality, which, while expected for a SAST tool, increases the impact if combined with prompt injection.
Evidence: semgrep ci, semgrep scan, semgrep validate, and various installation commands (pipx install, brew install).

semgrep-rules