The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it is designed to ingest and process untrusted external data (bug reports and target source code) to inform its decision-making. Maliciously crafted source code could attempt to influence the agent's logic or bypass its review criteria.
Ingestion points: The agent reads external findings files and the actual source code of the project being audited (SKILL.md).
Boundary markers: Absent. The instructions do not specify the use of markers or delimiters to separate untrusted code content from the agent's internal instructions.
Capability inventory: The skill can execute shell commands via local Node.js scripts and write JSON artifacts to the local file system.
Sanitization: Absent. There are no instructions to sanitize or validate the data extracted from source code (such as library names or framework claims) before passing them as arguments to the documentation lookup scripts.
[COMMAND_EXECUTION]: The skill documentation provides explicit instructions for the agent to execute shell commands using Node.js. It calls local scripts (doc-lookup.cjs and context7-api.cjs) located in the $SKILL_DIR/scripts/ directory to perform documentation searches. While these scripts are part of the skill's own package, the arguments passed to them (such as library names and technical questions) are derived from the untrusted project data being reviewed.

skeptic