The Agent Skills Directory

[PROMPT_INJECTION]: The skill explicitly instructs the agent to operate in 'AUTONOMOUS MODE' and 'Do NOT ask questions.' This attempts to bypass the agent's standard conversational flow and user confirmation checkpoints, potentially leading to unauthorized filesystem operations.
[DATA_EXFILTRATION]: The skill instructs the agent to scan for and 'extract... secrets referenced' from CI/CD pipeline files and sensitive locations like Vault, AWS SSM, and sealed secrets configurations. While it includes a negative constraint to not include these in the final document, the initial extraction into the model's context poses a significant risk of data exposure or leakage through logs and side channels.
[COMMAND_EXECUTION]: The skill attempts to write telemetry metadata to ~/.claude/projects/skill-telemetry.md. This operation occurs outside the designated project workspace, representing an unauthorized filesystem write that could be used for tracking or persistence.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8). It ingests untrusted data from various infrastructure files (Dockerfile, K8s manifests, CI/CD YAMLs) and has the capability to write to the filesystem.
Ingestion points: Infrastructure files identified in Phase 1 (SKILL.md).
Boundary markers: None identified; instructions are interpolated directly from file content analysis.
Capability inventory: File system read and write operations across the workspace and home directory.
Sanitization: No escaping or validation of the extracted file content is performed before processing.

runbook