The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a broad set of shell tools (git, gh, grep, rg, npx, curl) to perform repository reconnaissance, audit git history, and probe live application endpoints. This includes running a vendor-provided CLI tool via npx @codespring-app/cli.
[REMOTE_CODE_EXECUTION]: The specialist agent instructions for 'core business logic' include a directive to extract logic from the audited repository into a 'scratch harness' and execute it using node or python3 to verify outputs. While this is used for diagnostic verification, executing untrusted code from an audited codebase is a form of remote code execution.
[CREDENTIALS_UNSAFE]: The scripts/check-repo.sh utility and the security specialist brief explicitly search the repository's git history for sensitive patterns such as BEGIN PRIVATE KEY and service_role. This activity is intended for discovery during an audit rather than malicious harvesting.
[INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection as it ingests and analyzes an entire untrusted codebase.
Ingestion points: All files and git metadata within the audited repository (<absolute repo path>).
Boundary markers: The skill uses labels (CONFIRMED, INFERRED, UNVERIFIED) to separate evidence, though it lacks explicit sanitization for code snippets embedded in reports.
Capability inventory: The agent has broad shell access, network capabilities via curl, and the ability to execute Node.js and Python scripts.
Sanitization: There is no explicit logic mentioned for escaping or filtering malicious instructions that might be hidden in code comments or metadata of the audited project.

cs-build-audit-codebase