The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructions in Step 0 direct the agent to actively scan the workspace for sensitive information, including database connection strings, Slack bot tokens, and email/SMTP configurations stored in .env files or other configuration scripts. This is intended for environment discovery but involves accessing sensitive paths.
[COMMAND_EXECUTION]: The agent is instructed to use shell tools like Bash, Grep, and Glob to search for docker-compose.yml, crontab, and systemd timers to identify existing scheduling infrastructure.
[PROMPT_INJECTION]: The skill exhibits vulnerability to indirect prompt injection due to its broad scanning of untrusted workspace files.
Ingestion points: Reads docker-compose.yml, .env, database configs, .github/workflows/, and dbt_project.yml files from the local workspace (SKILL.md).
Boundary markers: The instructions lack explicit delimiters or warnings to ignore instructions embedded within the scanned configuration files.
Capability inventory: The skill has access to Bash, Write, Edit, WebFetch, and WebSearch tools, allowing for significant downstream actions based on potentially malicious data ingested from files.
Sanitization: There is no mention of sanitizing or validating the content of the discovered configuration files before processing.

lens-report