The Agent Skills Directory

[DATA_EXFILTRATION]: The skill explicitly instructs the agent to exfiltrate sensitive data, including flags, secrets, and environment variables, to external domains (e.g., attacker.com) via HTTP and DNS. Evidence of these patterns is found in SKILL.md (Section 5.4) and references/supply-chain-attack.md (Section 4.3).
[CREDENTIALS_UNSAFE]: Instructions direct the agent to harvest credentials and secrets from sensitive system paths and files, such as /run/secrets/*, .env files, and process environment variables. Evidence is present in SKILL.md and references/supply-chain-attack.md (Section 4.2).
[COMMAND_EXECUTION]: The skill provides numerous shell commands for the agent to execute, including curl, nslookup, find, cat, and various security scanners (katana, nuclei, subfinder), which constitute a powerful capability set for both reconnaissance and exploitation.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from source files and logs, which creates an attack surface for indirect prompt injection given the skill's high-privilege capabilities.
Ingestion points: The skill reads package.json, composer.json, package-lock.json, Gemfile, pom.xml, and CI/CD build logs (SKILL.md, references/supply-chain-attack.md).
Boundary markers: No delimiters or safety warnings to ignore instructions inside processed files were identified.
Capability inventory: The skill uses curl, nslookup, find, cat, and various security tools to perform network and file operations.
Sanitization: No validation or sanitization of ingested content is mentioned.

supply-chain-audit