The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from a codebase using tools like Read, Grep, and Bash. This creates an attack surface where malicious instructions embedded in the target code could influence the agent's research report or subsequent actions.\n- Ingestion points: Codebase files accessed via Read, Grep, Glob, and Bash tools as described in the Investigation and Repository Tracing sections (SKILL.md).\n- Boundary markers: The instructions provide guidelines for structured output but lack explicit requirements for sanitizing or delimiting content extracted from the codebase to prevent instruction confusion.\n- Capability inventory: The skill possesses the ability to read files, execute shell commands via Bash, and write findings to the file system (SKILL.md).\n- Sanitization: Validation scripts (scripts/codebase-recon/validate-output.sh, scripts/pattern-mining/validate-output.sh) check the structural integrity and cryptographic hashes of reports but do not perform content-level sanitization against prompt injection.\n- [COMMAND_EXECUTION]: The skill utilizes Bash for repository tracing and to run validation scripts. While these are necessary for its intended purpose of repository analysis, they represent a significant capability.\n- Evidence: The SKILL.md frontmatter lists Bash in allowed-tools. The validation scripts (scripts/codebase-recon/validate-output.sh) perform extensive Git operations and system checks using standard utilities like stat, sha256sum, and jq.

research