The Agent Skills Directory

[PERSISTENCE]: The script scripts/insert_doc_governance.py and the instructions in references/maintenance-workflow.md implement logic to automatically inject and upgrade a 'Project Documentation Management' section into global user-level instruction files. Specifically, it targets files in the user's home directory such as ~/.claude/CLAUDE.md, ~/.codex/AGENTS.md, ~/.agents/AGENTS.md, and others. This allows the skill to persist instructions across all future agent sessions and different projects by modifying global configuration files.
[DATA_EXFILTRATION]: The scripts/db_miner.py script is designed to discover database connection strings, test those connections, and sample data from discovered databases. The script allows for the extraction of sensitive data such as table schemas and sample rows. Crucially, the masking of sensitive information (passwords, tokens) is optional and controlled by an argument, posing a significant risk of exposing raw credentials and sensitive business data during the documentation process.
[DATA_EXFILTRATION]: The script scripts/discover_global_instruction_files.py scans for sensitive configuration and instruction files located in various hidden directories within the user's home folder (e.g., .claude, .codex, .config/opencode). This represents a targeted scan of sensitive file paths outside the current project scope.
[CREDENTIALS_UNSAFE]: The file references/database-mining/config-discovery.md contains an example connection string with hardcoded credentials (postgresql://user:password@localhost:5432/app). Furthermore, the db_miner.py utility is specifically engineered to locate and extract plaintext database credentials from various configuration file formats within a project.
[COMMAND_EXECUTION]: Several scripts, including depth_scanner.py, doc_coverage.py, and git_history_miner.py, utilize the subprocess.run method to execute shell commands (primarily git). While these are targeted at metadata extraction, the execution of subprocesses presents a potential attack vector if inputs to these scripts are not strictly sanitized.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface as it is designed to ingest and process a wide variety of untrusted data, including project source code, documentation files, and database content. This data could contain malicious instructions designed to bypass agent constraints or manipulate the resulting documentation artifacts.

doc-init