The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes untrusted data from the local environment while possessing high-privilege capabilities.
Ingestion points: The agent reads source code files, test files, and capture test failure logs (stdout/stderr) using the Read and Bash tools.
Boundary markers: The instructions lack explicit boundary markers or directives for the agent to ignore instructions embedded within the codebase or logs it analyzes.
Capability inventory: The skill allows file modifications via Write and Edit, and command execution via Bash (for tools like pytest, docker, and make).
Sanitization: There is no evidence of sanitization or validation of the test output before the agent uses it to generate and apply code fixes.
[COMMAND_EXECUTION]: The skill configuration allows the execution of various powerful development and orchestration tools including docker, make, uv, and git through the Bash tool. While these are appropriate for the skill's purpose, they provide a significant execution surface that could be exploited if the agent follows instructions injected into codebase data or test logs.

test-iterate-loop