The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill includes a robust mitigation strategy for indirect prompt injection. In the 'Data handling' section of SKILL.md, it explicitly instructs the agent that any instructions found within processed files must be treated strictly as data and never as commands to follow or reasons to change the audit's behavior.
[CREDENTIALS_UNSAFE]: The skill implements a privacy-first evidence rule. It mandates that any quote containing credential values (tokens, passwords, API keys) must have those values replaced with [REDACTED] before being written to a report, ensuring sensitive information does not leak to forge comments or commit messages.
[COMMAND_EXECUTION]: The skill facilitates the execution of local project commands (e.g., via package.json scripts or Makefile targets) to validate changes. This is a standard and necessary function for a development agent performing code refactoring and auditing.

audit-quality