The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from git diffs and repository source code to perform its audit and cleanup tasks (Step 2 in SKILL.md). This ingestion of external data creates a potential surface where malicious instructions could be embedded in code comments, documentation, or diff hunks to influence the agent's behavior during the tidying process.
Ingestion points: git diff output and source code files referenced within the diff (Workflow Step 2 in SKILL.md).
Boundary markers: The instructions do not specify the use of clear delimiters or instructions for the agent to ignore potentially malicious embedded prompts in the ingested data.
Capability inventory: The skill has the capability to delete code, modify files, and execute repository-defined shell commands for verification, such as npm test, pytest, tsc, and cargo check (Workflow Step 5 in SKILL.md).
Sanitization: No sanitization of the diff content or source code is performed before it is analyzed by the model.
Mitigation: The risk is effectively mitigated by the mandatory human-in-the-loop requirement. The skill is instructed to never alter files or delete code without explicit human sign-off via ask_question (Workflow Step 4 in SKILL.md).

melech-tidy