The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is highly susceptible to indirect prompt injection because its core functionality involves reading and 'interrogating' untrusted data sources including application code, live database records, and project plan files. Maliciously crafted comments in code or data values in the database could attempt to influence the sub-agents' findings or the orchestrator's final verdicts.
Ingestion points: The skill ingests data in Stage 0 (actual records/code samples), Stage 1 (live DB introspection, app code analysis, and plan document parsing), and Stage 2 (entity-level evidence gathering).
Boundary markers: The instructions lack explicit boundary markers or delimiters that would instruct the model to treat the ingested data strictly as non-instructional text, increasing the risk that the model might follow embedded instructions.
Capability inventory: The skill has the capability to read any file in the codebase and any accessible database record. The orchestrator can perform surgical modifications to files using StrReplace or Edit tools, which could be leveraged if the agent is successfully injected.
Sanitization: There is no evidence of sanitization or filtering of the external content before it is processed by the sub-agents or the main orchestrator.

dissect