The Agent Skills Directory

[PROMPT_INJECTION]: The skill is subject to an indirect prompt injection attack surface because its primary function is to ingest and process untrusted source code from external repositories.
Ingestion points: The workflow resolves a scan target (either a full repository or a scoped path) and reads all files within that scope for analysis.
Boundary markers: The skill relies on subagent workers following references/phase-finding-discovery.md and includes a centralized validation phase (references/phase-validation.md) to verify findings.
Capability inventory: The agent can read repository files, execute local Python utility scripts, and write artifact files to specific discovery and findings directories.
Sanitization: The process includes a mandatory validation tail and attack-path analysis designed to evaluate the technical plausibility of candidates discovered in the source code, serving as a mitigation against malicious instructions embedded in the scanned files.
[COMMAND_EXECUTION]: The skill executes local Python scripts to manage the scanning lifecycle and artifact generation.
Evidence: It invokes <python_command> <plugin_dir>/scripts/generate_rank_input.py to create worklists and python <plugin_dir>/scripts/finalize_scan_contract.py to compile the final markdown report. These scripts are located within the skill's own plugin directory.

security-deep-scan