The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to recursively read and analyze all files within a project to identify and fix issues ("Read all files
Scan every file in the project recursively", "Automatically scan and understand the entire codebase").
Ingestion points: Every source file, configuration file, and document in the project directory is ingested via listDirectory and readFile (SKILL.md).
Boundary markers: The skill lacks delimiters or specific instructions to ignore malicious natural language instructions embedded within comments or code strings in the audited files.
Capability inventory: The skill possesses extensive file system capabilities including readFile, strReplace, and the ability to create new files and execute test suites.
Sanitization: There is no evidence of sanitization or filtering of the ingested content to prevent the agent from obeying instructions hidden within the target codebase.
[DYNAMIC_EXECUTION]: The skill performs runtime code generation and modification ("Refactor architecture", "Add missing tests", "Use strReplace to fix issues in files"). It then executes these modified or newly created scripts during the verification phase ("Run all tests to ensure nothing broke"), which constitutes dynamic execution of potentially untrusted content.
[PROMPT_INJECTION]: The instructions contain several directives that command the agent to bypass standard user confirmation and oversight ("Do this automatically without asking the user", "Don't Ask Questions", "Don't Wait for Instructions"). These patterns promote high autonomy and reduce human oversight, which can be exploited to conceal unauthorized changes or facilitate other attacks if the agent is compromised via indirect injection.
[COMMAND_EXECUTION]: The skill is instructed to run project tests and perform codebase modifications, which involves executing shell commands and scripts within the user's environment to verify the "production readiness" of the code.

production-code-audit