The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is instructed to "Read the codebase" (Step 0) and identify components from project files. If these untrusted files contain malicious instructions, they could influence the agent's behavior.
Ingestion points: Reads the entire codebase, including project configuration, package manifests, and existing architecture documentation (SKILL.md, Step 0).
Boundary markers: None. The instructions do not define delimiters or warnings to ignore instructions found within the processed code.
Capability inventory: The skill has access to Bash, Write, Edit, WebFetch, WebSearch, Task, and TodoWrite.
Sanitization: None. The agent processes raw codebase content directly without sanitization or filtering.
[PROMPT_INJECTION]: Metadata Inconsistency. The version listed in SKILL.md (0.6.4) does not match the version in plugin.json (1.9.1), which can be indicative of poor synchronization or misleading versioning.
[COMMAND_EXECUTION]: The skill is granted Bash and Task tools. While intended for structural analysis, the combination of these tools with the instruction to scan the entire codebase allows the agent to execute shell commands if it encounters executable content or is influenced by instructions in the project files.
[EXTERNAL_DOWNLOADS]: The skill uses WebFetch and WebSearch to identify external actors and SaaS dependencies. This allows the agent to make outbound network requests based on information discovered in the codebase.
[CREDENTIALS_UNSAFE]: The skill explicitly directs the agent to scan for "connection strings" (SKILL.md, Step 0) to identify data stores. This pattern increases the risk of sensitive credentials being loaded into the agent's context, potentially exposing them if the agent is manipulated or makes external requests.

atlas-map