The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external codebases, which represents an attack surface where malicious code could attempt to influence the agent's behavior.
Ingestion points: The skill reads repository contents, git diffs, pull requests, and file paths provided by the user (SKILL.md).
Boundary markers: The instructions define specific roles and phases but do not establish explicit boundary markers (like delimiters) between the untrusted target code and the agent's instructions.
Capability inventory: The skill utilizes file searching (rg), version control (git), and language server protocol (LSP) tools. It also involves sub-agents capable of writing and executing scripts for proof-of-concept verification.
Sanitization: The skill does not explicitly describe sanitization or filtering of the target code before it is processed by the hunter and PoC agents.
[COMMAND_EXECUTION]: The workflow involves executing various shell commands to map the attack surface and verify findings.
Reconnaissance tools: Uses rg, git diff, and git log to baseline the target scope.
PoC execution: Instructs PoC engineers to report exact commands and observed output, implying shell execution of generated tests.
[DYNAMIC_EXECUTION]: The skill facilitates the creation and execution of proof-of-concept scripts to verify vulnerabilities.
Safety constraints: The instructions mitigate risks by mandating the use of local fixtures, toy payloads, and dry runs, while explicitly forbidding destructive exploits against real services or third-party systems.

security-research