The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted source code and project instruction files (e.g., CLAUDE.md, AGENTS.md) from a codebase. This presents an attack surface for indirect prompt injection, where an attacker could embed malicious instructions in the code to influence the agent's behavior during analysis.\n
Evidence Chain:\n
Ingestion points: The skill reads source files (.py, .js, .java, etc.) and markdown documentation files via analyze_file.py, ast_parser.py, and doc_review.py.\n
Boundary markers: The skill uses structured templates for output but does not employ explicit boundary markers for the analyzed content to prevent instruction following.\n
Capability inventory: The scripts can execute shell commands (git, grep, formatters) and perform file system operations (writing reports, modifying documentation, and rewriting comments).\n
Sanitization: Input sanitization is present for symbol names (in usage_finder.py) and path validation is implemented (in doc_review.py) to prevent path traversal.\n- [DYNAMIC_EXECUTION]: The adapter loader in scripts/languages/_treesitter.py uses the __import__ function to dynamically load language-specific tree-sitter grammars. While the module names are derived from a hardcoded mapping (_GRAMMAR_MODULES), this pattern involves loading executable code based on variables determined at runtime.\n- [COMMAND_EXECUTION]: Several scripts utilize subprocess.run() to invoke external utilities for project analysis:\n
scripts/snapshot.py executes git commands for repository metadata and status.\n
scripts/usage_finder.py executes rg (ripgrep) or grep to find symbol references across the project. Symbol names are sanitized before being passed to the shell.\n
scripts/comment_rewriter.py executes a predefined list of code formatters (e.g., ruff, black, prettier, rustfmt) to clean up source code after rewriting comments.

xray-method