The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes external Java source code, which creates a surface for indirect prompt injection. A malicious file could theoretically contain instructions intended to manipulate the agent's review. However, this risk is considered safe due to the skill's restricted environment.
Ingestion points: The skill reads Java class files and package directories using the Read tool as described in Step 2 of the instructions.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to disregard instructions embedded within the analyzed source code (e.g., in comments or string literals).
Capability inventory: The skill is restricted to read-only operations using Read, Glob, and Grep. It does not have access to tools for file-writing, network communication, or shell execution, which prevents any potential injection from escalating into a meaningful attack.
Sanitization: The skill does not implement specific sanitization or filtering for the content of the files it analyzes.
[SAFE]: The skill is designed for static code analysis. The examples provided in the documentation—such as hardcoded credentials and SQL injection snippets—are clearly marked as examples of vulnerable code for the agent to identify and correct, rather than malicious code within the skill itself. The skill's behavior is consistent with its stated purpose.

java-best-practices-code-review