The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions in SKILL.md and references/repository.md direct the agent to read and adopt instructions found within the repository being reviewed, specifically targeting files like AGENTS.md and "applicable local instructions."
Ingestion points: Files within the analyzed repository, including AGENTS.md, contributor guidance, and package configuration files (SKILL.md Section 2, references/repository.md).
Boundary markers: None. The skill explicitly tells the agent that these "Repository rules define severity and required validation," giving them high precedence over default behavior.
Capability inventory: The agent is authorized to read files, execute shell commands (git, lint, test), perform network probes, and use browser automation tools (references/validation.md).
Sanitization: There are no instructions to sanitize or ignore potential prompt injection markers within these local repository files, creating a surface where a malicious repository could influence the agent's execution logic or exfiltrate data via authorized tools.

code-review