The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by ingesting and acting upon data from external files.
Ingestion points: The skill reads findings.json, specifically the evidence and recommendation fields which provide instructions for the patch.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands within the findings data are provided in the skill text.
Capability inventory: The skill has the capability to write files (patches/<id>.diff), modify the status in findings.json, and execute shell commands including git worktree, git apply, and the project's own test suite.
Sanitization: There is no mention of sanitizing or validating the content of the recommendation field before the agent uses it to generate code or modify the environment.
Risk: A malicious finding or compromised findings.json could contain instructions that trick the agent into performing destructive actions or inserting backdoors under the guise of a 'security fix' during the patching phase.

sec-fix