The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill identifies several ingestion points for untrusted data which could be used for indirect prompt injection attacks.
Ingestion points: The improve.md subcommand ingests untrusted data from WebSearch results to generate insights and PRDs. Additionally, learn.md, security.md, and regression.md ingest content from the project codebase (source files, manifests, and git history) which could be controlled by an external attacker in shared environments.
Boundary markers: The skill does not explicitly define unique delimiters or instructions for the agent to ignore embedded commands within the ingested data during interpolation.
Capability inventory: The skill has powerful capabilities, including the ability to execute shell commands (Verify, Guard, Target), perform file operations via git (revert, commit, worktree), and perform network operations via WebSearch.
Sanitization: The skill includes robust sanitization for specific risks, such as a multi-layered secret scrubber in learn.md (post-generation grep for keys and tokens) and a command safety screen in plan.md and autoresearch.md. However, it lacks generic sanitization against prompt-based instruction overrides in untrusted inputs.
[COMMAND_EXECUTION]: The skill's core loop relies on the execution of shell commands provided by the user or derived by the agent.
Evidence: The protocols in autoresearch.md, fix.md, regression.md, and plan.md require the execution of Verify, Target, and Guard commands to measure project metrics and ensure code stability.
Mitigation: The skill implements a 'Verify Safety Screen' before executing derived commands, which checks for dangerous patterns including rm -rf, fork bombs, curl|sh pipes, embedded credentials, and unauthorized outbound writes.

autoresearch