The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes the contents of local repositories to generate documentation, which constitutes an ingestion of untrusted data. This provides a surface for indirect prompt injection if a file within the repository contains instructions designed to manipulate the agent's behavior during analysis.\n
Ingestion points: scripts/analyze-repo-structure.py and scripts/find-integration-points.py recursively scan repository files. SKILL.md specifies a 'Repository Analysis' phase where the agent is instructed to discover key files and structure.\n
Boundary markers: The instructions lack specific boundary markers or 'ignore' commands for the content being analyzed.\n
Capability inventory: The agent can read and edit files in the workspace and execute local Python scripts.\n
Sanitization: No sanitization or filtering of codebase content is performed before it is processed by the agent.\n- [INDIRECT_PROMPT_INJECTION]: The presence of skill-report.json constitutes a self-referential finding. The file contains a pre-authored security audit claiming a 'safe' risk level and 'false positive' adjudication for potential findings. This content targets the analyzer itself and could be used to deceive security evaluations.\n
Evidence: skill-report.json includes fields like "risk_level": "safe" and a summary stating "static hits were adjudicated as false positives".

repo-docs