The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of caller files and diffs. This creates a surface for indirect prompt injection where malicious instructions hidden in comments or code strings could influence the agent's behavior.
Ingestion points: The skill ingests data via the 'Scope' section and Step 1 in SKILL.md, which includes 'caller's files or diff' and the 'working tree'.
Boundary markers: No explicit boundary markers or 'ignore embedded instructions' delimiters are used when passing the scope to the subagent or processing it locally.
Capability inventory: The skill possesses significant modification capabilities, including deleting code paths (Step 3), implementing root-cause fixes (Step 4), and spawning subagents (Step 1).
Sanitization: No sanitization, escaping, or validation of the ingested code content is performed before it is analyzed by the AI model.
[COMMAND_EXECUTION]: While intended for maintenance, the skill is instructed to perform direct code modifications (deleting dead paths, dropping parameters) based on the output of an 'aggressive' subagent. The instruction in SKILL.md Step 2 to delete content if a 'keep' is ambiguous increases the risk of accidental functional corruption if the agent is manipulated by the file content.

no-comments