The Agent Skills Directory

[DATA_EXPOSURE]: The skill performs environment detection by scanning for files like Matchfile, .mobileprovision, and .gradle to identify the project's code signing configuration. This is a legitimate requirement for automating mobile release pipelines.
[INDIRECT_PROMPT_INJECTION]: The skill reads external project files such as package.json, pubspec.yaml, and Fastfile using shell commands.
Ingestion points: Files are read via cat and grep in SKILL.md (Step 0).
Boundary markers: None used during file reading.
Capability inventory: The skill uses Bash, Write, Edit, and WebFetch tools.
Sanitization: No explicit sanitization of read data is performed, though the data is primarily used for identifying project type and state.
[SAFE]: The skill includes explicit security best practices, such as recommending that users do not commit match passphrases or Android keystore passwords to the repository.

touch-release