The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources, creating a potential attack surface where malicious instructions within a target repository could influence the agent's behavior.
Ingestion points: Target repository source code, README files, and external documentation such as Confluence or Notion exports (SKILL.md §Inputs).
Boundary markers: The skill does not explicitly define delimiters or instructions to ignore embedded commands within the ingested content, although it uses a structured output format for findings.
Capability inventory: The skill can execute shell commands (gh, bun, ls, grep, find, curl) and write files to the .context/ directory (SKILL.md §Compact Rules).
Sanitization: The skill contains explicit rules against pasting detected credentials into its output and uses a 'Discovery Gaps' section to manage unverified information (SKILL.md §Gotchas).
[COMMAND_EXECUTION]: The skill makes extensive use of system commands to discover the project's structure, tech stack, and environment configuration.
Evidence: Executes ls, grep, find, cat, and jq for file system analysis; gh for repository metadata; and bun run for internal scripts like jira:check and context:map (SKILL.md, references/phase-1-constitution.md). These are used within the scope of its primary purpose.
[EXTERNAL_DOWNLOADS]: The skill references documentation and methodology from external URLs belonging to the vendor.
Evidence: Links to upexgalaxy.com/metodologia and upexgalaxy.com/en/methodology for methodology guidance (SKILL.md). These are legitimate vendor resources and do not contribute to a higher severity verdict.

project-discovery