The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The file references/codebase-understanding.md explicitly instructs the agent to "Analyze dotenv files and configuration". Accessing .env files is a high-risk activity as these files typically contain sensitive credentials, API keys, and environment-specific secrets. This information could be inadvertently exposed if the agent includes it in its thinking process or the generated implementation plans.
[COMMAND_EXECUTION]: In references/research-phase.md, the skill directs the agent to execute the repomix command using a remote repository URL (repomix --remote <github-repo-url>). This involves performing network operations and shell execution based on external, potentially untrusted inputs.
[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection (Category 8).
Ingestion points: The agent is instructed to read external repository content via repomix, GitHub metadata (actions, PRs, issues) via the gh tool, and local codebase documentation.
Capability inventory: The agent has the ability to execute shell commands (repomix, gh), write files to the local filesystem (plans/ directory), and spawn other specialized agents (researcher, scout, debugger).
Boundary markers: There are no explicit instructions or delimiters provided to the agent to treat external data as untrusted or to ignore instructions embedded within that data.
Sanitization: No sanitization or validation of external content is specified before it is integrated into the agent's planning and decision-making process.

planning