The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local repository, creating a potential attack surface for indirect prompt injection.
Ingestion points: SKILL.md (Flow step 2: Explore) instructs subagents to read source code files within specific territories.
Boundary markers: The explorer brief lacks explicit delimiters or warnings to ignore instructions embedded within the scanned source code.
Capability inventory: The skill can spawn subagents (Agent tool), write to the file system (temporary directory, .crank/ directory, and CONTEXT.md), and open files in the system browser.
Sanitization: There is no mention of sanitizing source code symbols or comments before they are included in the synthesized HTML report or the subagent exploration results.
[DYNAMIC_EXECUTION]: The skill generates a self-contained HTML report in the temporary directory that is executed in the user's browser.
Evidence: HTML-REPORT.md specifies the creation of an HTML file that includes JavaScript logic. Specifically, it initializes the Mermaid diagram library with securityLevel: "loose". This configuration allows HTML tags within diagrams, which could lead to cross-site scripting (XSS) if the AI includes malicious snippets from the scanned codebase into the report.
[EXTERNAL_DOWNLOADS]: The generated report fetches configuration and libraries from well-known external services.
Evidence: HTML-REPORT.md includes scripts from cdn.tailwindcss.com and cdn.jsdelivr.net (Mermaid library). These are established services used for legitimate web development purposes.
[COMMAND_EXECUTION]: The skill executes system commands to display the generated report.
Evidence: SKILL.md uses platform-specific commands like open, xdg-open, or start to open the HTML report file located in the temporary directory.

crank-deepen