The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external feedback files provided via the $ARGUMENTS parameter.
Ingestion points: The skill reads an external file (e.g., from an LLM, human, or CI tool) to extract feedback items for processing as seen in SKILL.md.
Boundary markers: Feedback items are parsed and passed to subagents or sequential execution blocks. While the items are formatted into a 'Fix Dispatch Template', the instructions lack explicit delimiters or warnings to the agent to ignore instructions embedded within the feedback text itself.
Capability inventory: The skill has high-privilege capabilities including reading files, searching the codebase (Grep), executing local tests/scripts, and editing code to apply fixes.
Sanitization: There is no evidence of content sanitization or validation. The 'Fix-Quality Contract' explicitly directs the agent to 'implement the reviewer's suggestion as written', which facilitates an attack where malicious feedback content could lead to unauthorized code changes or sensitive data access.
[COMMAND_EXECUTION]: The skill workflow requires the agent to execute shell commands to verify claims and validate implementations.
Evidence: VERIFICATION.md instructs the agent to 'reproduce with test or script' and 'run linter'. SKILL.md requires running 'the project's typecheck / lint'.
Risk: This intended functionality allows for the execution of code within the local environment. If an attacker-controlled feedback file can influence the choice of tests or the parameters of these commands, it could lead to the execution of malicious local scripts.

receive-feedback