The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data in the form of the caller's files or diffs. This creates a surface for indirect prompt injection where malicious instructions embedded in code comments could manipulate the agent or the sub-agent (comment-sicko) tasked with cleaning the code.
Ingestion points: The skill reads the 'caller's files or diff' as specified in the Scope section.
Boundary markers: No explicit boundary markers or 'ignore embedded instructions' warnings are provided to prevent the agent from obeying instructions found within the code being analyzed.
Capability inventory: The skill uses the task tool for delegation and can perform file system modifications (deletions, parameter changes, and code implementation) directly or via the architect skill.
Sanitization: The skill relies on complex conditional logic and manual-style review steps ('Reject application-code edits', 'Audit missed scoped lint') rather than robust structural sanitization or output validation.
[COMMAND_EXECUTION]: The skill invokes several external tools and capabilities, which, while standard for this platform, increase the impact of a successful injection attack.
Evidence: Mentions the task tool and references several other skills (skill://poteto-mode, skill://how, skill://why, skill://architect, etc.) to perform complex reasoning and code modifications.
[DATA_EXPOSURE]: While the skill primarily focuses on cleanup, it operates on the project's source code and working tree, meaning any injection that compromises the agent's logic could potentially lead to unauthorized access or modification of sensitive project files.

no-comments