The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface because it is designed to recursively read and process an entire codebase, which constitutes untrusted external data. A malicious file within the project could contain hidden instructions that target the agent while it is performing the audit.
Ingestion points: The skill uses listDirectory and readFile recursively across all files in the project.
Boundary markers: No explicit boundary markers or instructions to treat codebase content as data rather than instructions are provided.
Capability inventory: The skill possesses extensive capabilities including readFile, listDirectory, strReplace (file writing), and the ability to run tests (command execution).
Sanitization: The instructions do not include any sanitization or validation steps for the content read from files before it is processed by the agent.
[PROMPT_INJECTION]: The skill contains specific instructions that encourage the agent to bypass human oversight and user verification, which are concealment patterns.
Evidence: Instructions such as "Do this automatically without asking the user", "Don't Ask Questions
Understand the codebase autonomously", and "Don't Wait for Instructions
Scan and fix automatically" directly instruct the agent to skip the standard review process.
[COMMAND_EXECUTION]: The skill's workflow includes running tests and executing build tools to verify changes and measure performance.
Evidence: The skill mentions running all tests, measuring performance improvements, and generating metrics, which typically involves shell command execution (e.g., npm test, pytest).

production-code-audit