The Agent Skills Directory

[SAFE]: The skill consists of instructional markdown files and a simple configuration YAML. No malicious patterns, data exfiltration, or remote code execution vulnerabilities were found.
[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read CONTEXT.md if it exists. While this represents a data ingestion surface, the skill does not expose dangerous capabilities or perform network operations that could be exploited by malicious content in that file.
[CREDENTIALS_UNSAFE]: A code example in mocking.md mentions process.env.STRIPE_KEY to demonstrate poor testability patterns. This is a standard environment variable reference in documentation and does not contain a hardcoded secret.

tdd