The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local Python helper script (scripts/build_evidence_inventory.py) and standard Git binaries (git log, git show, git rev-list, git hash-object) to inventory project files and analyze repository history. These operations are restricted to the provided site root and are used for the intended purpose of comparing file versions and identifying exact matches.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface (Category 8) because its primary function involves the automated ingestion and analysis of untrusted external data (the website source code being audited).
Ingestion points: Files in the directories provided to the --site and --reference arguments are read by the read_text and git_history_matches functions in scripts/build_evidence_inventory.py to perform hashing and text shingling.
Boundary markers: While the instructions advise the agent to "Preserve the audit boundary," there are no technical delimiters or explicit system instructions to ignore embedded commands within the files being audited during the inspection phase.
Capability inventory: The agent is granted access to the Bash, Read, Write, Edit, and WebFetch tools, which could be targeted if malicious instructions are present in the audited source.
Sanitization: The Python script extracts hashes and shingles (8-word sequences), which limits the flow of raw executable instructions into the generated JSON report. However, the agent's workflow also involves manual inspection of the site content using tools like Read and Grep as described in the inventory instructions.

audit-reference-originality