The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted files from an external codebase without explicit boundary protection.
Ingestion points: The skill reads all project files, manifests, and documentation within the user-specified scope during the Map and Investigate phases (SKILL.md).
Boundary markers: Absent; the instructions do not include specific delimiters or directions for the agent to ignore or isolate instructions that may be embedded within the source code being reviewed.
Capability inventory: The skill possesses high-privilege capabilities including reading and writing files, executing shell commands (to run tests and builds), and performing web searches.
Sanitization: Absent; the agent processes the file content directly and incorporates findings into its decision-making process for implementation and execution.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to run the project's test suite, type checkers, and build scripts during the verification phase (SKILL.md, Phase 6). If a project's configuration (e.g., package.json scripts) is maliciously crafted, this could lead to arbitrary command execution on the host system.
[REMOTE_CODE_EXECUTION]: The skill includes a dedicated implementation phase where the agent is authorized to modify the codebase and execute changes. While this is the intended functionality for fixing identified bugs, it involves the generation and execution of code across the project, representing a significant capability tier.

vet