The Agent Skills Directory

[METADATA_POISONING]: The skill documentation in SKILL.md explicitly claims it is 'purely a read-only skill' and that 'no changes are to be made to the codebase.' However, the skill instructions and the included remediate-problem.md reference playbook provide detailed steps for an agent to create new git branches, push code, and open pull requests. This contradiction between stated purpose and actual capability could lead to a misjudgment of the skill's security impact.
[INDIRECT_PROMPT_INJECTION]: The skill audits content from 8 production codebases and documentation. Maliciously crafted data in these audited files could influence the generated compliance reports or trigger unintended actions by automated remediation agents that process the report's recommendations.
Ingestion points: Data is read from 8 production repositories, documentation files, and test suites across the workspace.
Boundary markers: The report generation process does not employ explicit boundary markers or delimiters to isolate untrusted content from the report structure.
Capability inventory: The skill can execute shell commands via subprocess.run, manage GitHub issues and pull requests via the gh CLI, and perform authenticated git operations.
Sanitization: There is no evidence of sanitization or escaping of extracted findings before their inclusion in markdown reports or GitHub issues.
[DYNAMIC_EXECUTION]: The skill uses subprocess.run to invoke the GitHub CLI (gh) and other local scripts to post audit results and manage repository state. While used for documented purposes, these patterns represent the execution of external tools based on programmatically determined arguments.

a2ui-audit