The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is explicitly authorized to execute the audited project's declared build and test tools, start local servers, and run browser automation flows. It also performs 'falsification probes,' which execute shell commands to verify that introduced code failures are correctly caught by existing tests.
[DATA_EXFILTRATION]: The skill requires network access for 'source verification' and has broad read access to all repository content, including source code, configuration files, and documentation. This combination creates a potential vector for the exfiltration of intellectual property or sensitive configuration data.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted repository content (source code, issues, and documentation) as its primary input. This creates an attack surface where maliciously crafted instructions embedded in the codebase could attempt to manipulate the agent's audit findings, severity assessments, or delegated subagent tasks.
Ingestion points: The agent reads all repository content, including source code, tests, fixtures, configuration files, and documentation (SKILL.md, 'Map before judging').
Boundary markers: While the skill mentions identifying 'trust boundaries' as an audit perspective, it lacks explicit delimiters or instructions to ignore embedded instructions within the ingested code.
Capability inventory: The skill can execute arbitrary local commands (build/test tools), start servers, access the network, and write finding artifacts to the filesystem.
Sanitization: There is no evidence of sanitization or escaping mechanisms for repository content before it is processed or included in audit findings reports.
[DYNAMIC_EXECUTION]: The 'falsification probes' mechanism involves programmatically introducing targeted mutations (wrong behaviors) into the source code and then executing the modified codebase. This represents a form of dynamic, self-modifying code execution at runtime.

codebase-audit