The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the repository being audited, including source code, configuration files (such as package.json, Dockerfile, and serverless.yml), and deployment manifests. This creates an attack surface where malicious code or instructions within the audited repository could attempt to subvert the agent's logic or influence its cleanup actions.
Ingestion points: Source code files, configuration files, and CI/CD manifests from the repository under audit are ingested into the agent's context during the detection and exoneration phases.
Boundary markers: The instructions do not define specific delimiters or "ignore" instructions for the agent to use when processing content from the repository, increasing the risk of the agent following instructions found within the code.
Capability inventory: The skill possesses significant capabilities including file system modification (logical code deletion), git operations (creating commits), and invocation of local build/test/lint tools.
Sanitization: The skill does not specify any sanitization, validation, or filtering of the ingested content before it is processed by the model.
[COMMAND_EXECUTION]: The skill instructs the agent to execute existing project tools found within the audited repository, such as linters, compilers, and coverage analysis suites. Executing these tools—especially for coverage analysis—often involves running the code within the repository. This represents a security risk if the repository contains malicious scripts or configurations designed to execute during the build or test process.

slop-audit