The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is designed to execute shell commands (e.g., npm test, pytest) that are defined within the project's own manifest files (Phase 5). If a malicious project defines these scripts to perform harmful actions, the agent will execute them with the user's local permissions.
[EXTERNAL_DOWNLOADS]: The skill dynamically installs software packages and testing tools based on its automated analysis of the local codebase (Phase 2c). This creates a supply chain risk if the codebase is designed to trigger the installation of malicious, vulnerable, or non-standard dependencies from public registries.
[DATA_EXFILTRATION]: During Phase 3a, the skill performs a comprehensive scan of the entire codebase to classify functionality and identify testing gaps. This broad access includes reading all source files and manifests, which may lead to the exposure of sensitive data, such as environment variables (.env files) or hardcoded credentials, if they are present in the project directory.
[PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection because it ingests and processes large amounts of untrusted data from the local project (manifests and source code) to inform its auditing and test-writing phases.
Ingestion points: Phase 1 (package manifests), Phase 3a (entire codebase scan).
Boundary markers: No explicit delimiters or warnings to ignore instructions embedded in the processed code are present.
Capability inventory: The skill possesses significant capabilities including package installation (Phase 2c), arbitrary shell command execution (Phase 5), and modification of source files (Phase 6).
Sanitization: The instructions do not specify any validation or sanitization of content read from the project before it is used to influence agent decisions.

fortify