The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by reading arbitrary files from the codebase (using Read, Grep, and Glob) to analyze bugs or verify fixes. It lacks boundary markers or explicit instructions to ignore or escape embedded instructions within those files, which could allow an attacker to manipulate the agent's behavior through malicious comments or code content.
[COMMAND_EXECUTION]: Phase 2C (Verify Mode) instructs the agent to execute test files from the tests/ directory using Bash. Although Bash is not listed in the allowed-tools frontmatter (effectively restricting its use in compliant environments), the presence of this instruction creates a risk of arbitrary code execution if the platform's tool restrictions are bypassed or if the agent utilizes a shell-based tool to fulfill the requirement on a compromised codebase.
[INDIRECT_PROMPT_INJECTION]: The skill maintains a mandatory evidence chain for Category 8:
Ingestion points: Files specified by the user or found via Glob/Grep are read in Phases 2A, 2B, and 2C.
Boundary markers: Absent; there are no delimiters or warnings provided to the agent regarding untrusted input in the instructions.
Capability inventory: The skill possesses the Write tool for filesystem modification and attempts Bash execution for test verification.
Sanitization: Absent; content from the filesystem is processed and interpreted directly to generate reports and drive logic.

bug-report