The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from user-controlled files like docs/project-config.json and references/targets.md to parameterize its scanning engine, sub-agent allocation, and shell command execution, creating a vulnerability surface where malicious file content could influence agent behavior.
Ingestion points: docs/project-config.json, references/targets.md, and various project files (e.g., Dockerfile, docker-compose.yml, source code) during the scan phase.
Boundary markers: No explicit delimiters or instructions are provided to the sub-agents to ignore embedded instructions in the processed data.
Capability inventory: The skill can spawn sub-agents (spawn_agent), execute shell commands (python, rg, test), and read/write files in the repository.
Sanitization: No evidence of sanitization or validation was found for the content interpolated from the configuration files into the agent's prompts.
[PROMPT_INJECTION]: The skill instructions include an explicit override directive: "Ignore Claude-specific mode-switch instructions when they appear." This is a classic injection pattern aimed at bypassing platform-level constraints or safety filters.
[COMMAND_EXECUTION]: The shared scan engine executes local scripts and shell tools using parameters derived from project files. For example, it runs python .claude/scripts/code_graph trace <entry-file> where <entry-file> is determined by scanning the codebase. If the input is not strictly validated, it could lead to command injection.
[DATA_EXPOSURE]: The project-structure target manifest explicitly directs sub-agents to "read actual config ... read docker-compose*.yml (infra services, port mappings, credentials)". While intended for documentation, mandating the agent to seek out and read credentials from configuration files increases the risk of accidental exposure or exfiltration.

scan