The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructs the 'Governance' lens (Lens 5) to access a hardcoded absolute system path outside the typical workspace.
Evidence: In references/lens-briefs.md, Lens 5 is explicitly instructed to "ensure components, dependencies, and tools adhere strictly to the Authoritative Platform Technology Stack (/home/ya/devd/technology_stack, specs 00–23)".
Risk: Accessing absolute paths like /home/ya/... can expose internal system structure, usernames, and environment configurations to the agent, which could then be exfiltrated or used for further reconnaissance of the host system.
[INDIRECT_PROMPT_INJECTION]: The skill processes arbitrary external files (artifacts) by passing them to subagents for analysis without adequate safety measures.
Ingestion points: The subagents are instructed in references/lens-briefs.md to "Hunt, in your FILE LIST only", where the file list contains arbitrary code or documentation from the repository being reviewed.
Boundary markers: The skill does not implement delimiters or explicit instructions for the subagents to ignore potential natural language commands embedded within the files (e.g., hidden instructions in markdown comments).
Capability inventory: The subagents are granted Read, Grep, and Glob tools, and their findings are synthesized by the orchestrator which has the ability to promote results via the submit-feedback tool.
Sanitization: There is no evidence of sanitization or filtering of the artifact content before it is processed by the subagent lenses.

preprod-review