The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection (Category 8) because it is designed to analyze untrusted external data (codebases, CI/CD configurations) provided via the $ARGUMENTS variable.\n
Ingestion points: Untrusted data is ingested into the agent context through the $ARGUMENTS placeholder in SKILL.md under the /audit-devops and /plan-devops sections.\n
Boundary markers: The instructions do not provide explicit delimiters or warnings to the agent to disregard any instructions found within the analyzed files.\n
Capability inventory: The skill directs the agent to create directories using shell commands (mkdir -p) and write multiple markdown files to the local file system as documented in SKILL.md.\n
Sanitization: There is a request for the agent to convert inputs into 'URL-safe' folder names, but no broader sanitization or escaping of the ingested content is defined.\n- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands (mkdir -p ./audit-reports/{target-slug}) where the folder name is derived from user-supplied input. Although the prompt requests a conversion to a 'URL-safe' format, this represents a potential command injection vector if the agent fails to properly sanitize the $ARGUMENTS string before execution.

zerubbabel-devops