The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process codebase content from the local filesystem, creating a pathway for malicious instructions embedded in data to influence agent behavior.
Ingestion points: The instructions in SKILL.md (Step 3 and Step 4) direct the agent to use Read, Grep, and Glob tools to retrieve content from various files in the project directory.
Capability inventory: The skill has access to the Bash tool, which allows for powerful operations including file modification and command execution.
Boundary markers: The instructions lack requirements for using unique delimiters or specific system messages to ensure the agent ignores instructions found within the analyzed source code.
Sanitization: There is no mention of sanitizing or escaping the content of the files before the agent processes or outputs it.
[DATA_EXFILTRATION]: The skill instructions explicitly encourage the agent to search for and identify sensitive information within the codebase, which could be a precursor to data exposure or exfiltration.
Evidence: SKILL.md includes specific search patterns for 'API_KEY' (Step 2) and environment variables such as process.env and os.environ (Step 4 under 'Find configuration').

codebase-search