The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a specific command-line tool, xcsym, using user-provided file paths. In Phase 2, the instructions state to run xcsym crash --format=summary <file> for .ips artifacts. This creates a potential command injection vector if the input file path is maliciously crafted and the agent platform does not perform adequate sanitization.
[INDIRECT_PROMPT_INJECTION]: The skill provides a significant surface for indirect prompt injection attacks because it is designed to read and interpret the contents of external, untrusted files.
Ingestion points: The skill uses Glob and Grep to find and read all **/*.swift files in a repository (excluding common test and vendor paths), as well as .ips crash reports.
Boundary markers: There are no instructions for the agent to use delimiters or ignore instructions embedded within the code or crash logs it analyzes.
Capability inventory: The agent has access to Glob, Grep, Read, and the ability to execute shell commands (xcsym).
Sanitization: The skill lacks any requirements for sanitizing the ingested data or validation logic to ensure that instructions hidden within comments or strings in the Swift source code do not influence the agent's behavior.

axiom-audit-concurrency