The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection attacks because it analyzes untrusted content such as source code, CI/CD configurations, and dependency manifests.
Ingestion points: The skill reads files including .github/workflows/*.yml, .gitlab-ci.yml, package.json, requirements.txt, and various source code files (Python, Java, Go, etc.) from the user's workspace as defined in the Workflow section of SKILL.md.
Capability inventory: The skill identifies and executes local security tools like semgrep, trivy, osv-scanner, checkov, and bandit, and performs grep operations on the files.
Boundary markers: The instructions in SKILL.md lack explicit delimiters or instructions to ensure the agent treats the content of analyzed files as data rather than instructions.
Sanitization: The skill does not perform any sanitization or validation of the input files before they are read and processed by the agent or the scanners.

integrity