The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes content from external code files identified during the 'Scope Detection' phase, which constitutes untrusted data.
Ingestion points: Code files read via the Read tool in SKILL.md (Step 1 and Step 3).
Boundary markers: Absent. The instructions do not mandate the use of delimiters (like XML tags) or system-level instructions to ignore embedded prompts when processing the content of files being audited.
Capability inventory: Read, Grep, Glob, Bash(git diff *), Bash(git log *). The skill's environment is restricted to read-only operations on the filesystem and lacks network tools (e.g., curl, wget).
Sanitization: Absent. The skill analyzes raw file content to identify patterns defined in references/security-checklist.md.
Risk: Maliciously crafted comments or code within a file being audited could attempt to manipulate the agent's reasoning, potentially causing it to overlook vulnerabilities or generate misleading reports.

security-review