The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill demonstrates a vulnerability to indirect prompt injection because it ingests untrusted content (local code files) and processes it using a high-capability sub-agent.
Ingestion points: The skill instructions specify that the agent 'gathers code files' from the current working directory to perform its analysis.
Boundary markers: The provided 'Consultant Prompt' does not define any delimiters or unique markers to separate the source code from the instructions, nor does it include a 'negative constraint' to ignore instructions found within the data.
Capability inventory: The skill invokes the Task tool with a specific subagent_type to analyze the code and generate a report, which could be manipulated if the source code contains malicious prompts.
Sanitization: There is no evidence of content escaping, filtering, or validation performed on the source code before it is interpolated into the consultant sub-agent's context.

analyze-code