The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes content from codebases, comments, and fetched web pages, which represents an injection surface. It implements comprehensive mitigations:
Ingestion points: Target source code, code comments, and external web content fetched during analysis are ingested into the agent context.
Boundary markers: All subagents are explicitly instructed to treat fetched content and in-code strings as data, never as instructions. Any instruction-like content directed at agents within these sources is flagged as a risk.
Capability inventory: The skill possesses the ability to modify local files and execute validation commands, but these are restricted by human-in-the-loop gates.
Sanitization and Control: A 'plan approval gate' requires user review before any modification occurs. The skill also enforces a strict validation safety policy to prevent the accidental execution of malicious code embedded in tests.
[COMMAND_EXECUTION]: The skill executes external validation commands. This is restricted to specific approved contracts provided by the user or identified by the mapper. The refactor-implementer is prohibited from inventing or running unapproved commands, and a safety classification system (safe, state-mutating, destructive) is used to gate potentially harmful operations.
[DATA_EXFILTRATION]: While the skill accesses local code and can fetch external pages, there are no patterns indicating data exfiltration. The instructions explicitly mandate that untrusted data from these sources must not influence the skill's scope, gates, or commands.

refactoring-code