The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface because it is designed to ingest and analyze untrusted external data, such as OpenAPI specifications, GraphQL schemas, and application source code, through the $ARGUMENTS parameter.
Ingestion points: Target files and directories provided via $ARGUMENTS are read and processed by the agent.
Boundary markers: The skill includes a dedicated 'Prompt Injection Safety Notice' section that explicitly instructs the agent to treat all reviewed content as untrusted data and to ignore any embedded directives.
Capability inventory: The skill is restricted to file system read operations (Read, Grep, Glob) and lacks the capability to execute code or perform network requests, which mitigates the risk of exfiltration or remote code execution.
Sanitization: The instructions contain explicit warnings against executing, evaluating, or interpreting code found within the reviewed files.
[SAFE]: The skill's metadata and instructional content are consistent with its stated purpose as an application security review tool. No obfuscation, persistence mechanisms, or unauthorized privilege escalation patterns were detected.

api-security