The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-provided source code which could contain malicious instructions embedded in comments or string literals intended to influence the agent's behavior during the refactoring process.
Ingestion points: The skill reads files or directories specified by the user at runtime as noted in the 'Scope' section of SKILL.md.
Boundary markers: There are no explicit delimiters or instructions to the agent to ignore embedded instructions within the source code being analyzed.
Capability inventory: The skill is granted the capability to "Make changes directly" to the target files, which could be abused if an injection causes the agent to write malicious code instead of refactoring it.
Sanitization: The skill does not perform sanitization or validation of the input code content, though the instruction to "Strip noise" (removing comments) may inadvertently delete injection payloads.
[COMMAND_EXECUTION]: The skill instructions in SKILL.md tell the agent to "run the project's lint or build command if one exists" to verify changes. This involves executing arbitrary commands defined within a project's configuration (e.g., in a package.json or Makefile), which could lead to code execution if the project being cleansed is malicious.

cleanse