The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill explicitly instructs the agent to read sensitive local configuration files which commonly contain secrets, API keys, and environment variables.
Evidence: In SKILL.md, the 'Before Reading Any Code' section states: 'open the project's actual config file (e.g. app.config.json, tauri.conf.json, package.json, .env) and lift the live value.'
Evidence: The 'Validate Before Handing Off' section requires that 'Every API key, token, and third-party account the plan requires listed with one-line explanations.'
Accessing .env files is a high-risk activity as they are the standard location for storing sensitive project credentials.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process a wide variety of potentially untrusted data sources to formulate plans, which can lead to the execution of malicious instructions embedded in that data.
Ingestion points: The agent is directed to read 'project docs, live external docs' (SKILL.md), 'ADRs, design docs, issue threads' (SKILL.md), and 'local agent-memory summaries' (references/durable-context.md). It also suggests studying implementations of 'mature open-source projects or direct competitors'.
Boundary markers: While the skill includes a 'redaction gate' in references/durable-context.md to strip sensitive information when creating durable rules, it lacks explicit delimiters or instructions to ignore embedded commands when processing general external documentation or issue trackers.
Capability inventory: The skill has the capability to read local files (including credentials), verify the reachability of external APIs and MCP servers, and execute implementation steps if authorized by specific user phrases.
Sanitization: There is no mention of sanitizing or escaping content retrieved from external documentation or public repositories before it is incorporated into the agent's reasoning process.

think