The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes explicit defensive instructions to ignore and report any 'ignore previous instructions' or similar injection patterns found within the audited repository content. This correctly treats untrusted repository content as data rather than executable instructions.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted repository data.
Ingestion points: Readme files, source code, git logs, and configuration files (SKILL.md).
Boundary markers: Hard Rule 6 explicitly commands the agent to treat all repo content as data and ignore embedded instructions.
Capability inventory: File system reads, shell execution of analysis tools, and spawning of subagents.
Sanitization: The skill mandates that injection attempts be recorded as security findings rather than being executed.
[CREDENTIALS_UNSAFE]: Hard Rule 4 prevents the agent from reproducing any discovered secrets (API keys, tokens, etc.) in its output. It enforces referencing location only and recommending rotation, which is an industry best practice.
[COMMAND_EXECUTION]: The skill restricts the agent to read-only analysis commands (e.g., tsc --noEmit, npm audit) and explicitly forbids any commands that mutate the user's working tree, such as npm install or git commit.
[REMOTE_CODE_EXECUTION]: The execute function dispatches implementation tasks to a subagent within an isolated git worktree. This provides process isolation, and the skill requires the host agent to review the resulting diff and run verification before any merge occurs.
[DATA_EXFILTRATION]: While the skill can create GitHub issues using the gh tool, it includes a mandatory security check that warns the user and requires explicit confirmation before publishing sensitive audit findings to public repositories.

audit