The Agent Skills Directory

[Indirect Prompt Injection Surface]: The skill's workflow involves reading and analyzing project files (.csproj, .sln) and C# source code (.cs) to identify nullable warnings and apply annotations. While this is the intended purpose, it creates a surface where malicious instructions embedded in a project's source code or comments could potentially influence the agent's behavior during the migration process.
Ingestion points: The scripts/Get-NullableReadiness.ps1 script reads file content via Get-Content and uses regex for analysis. The agent also manually reviews code per the workflow in SKILL.md.
Boundary markers: The instructions do not explicitly include boundary markers or "ignore embedded instructions" directives for the code being analyzed.
Capability inventory: The skill instructs the agent to execute build commands (dotnet build, msbuild), run tests, and perform file-write operations to update source code and project configurations.
Sanitization: The skill does not specify sanitization or escaping mechanisms for the data ingested from the source files before processing.
[Local Command Execution]: The skill workflow requires executing standard development tools and scripts to validate the migration.
Evidence: SKILL.md references the execution of dotnet build, msbuild, dotnet test, and user-provided build scripts, as well as the included scripts/Get-NullableReadiness.ps1 scanner. These are expected for a development-oriented migration skill.

migrate-nullable-references