The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes a self-referential verdict pattern within its workflow instructions.
Evidence: In references/claude-skill.md, the text states "Verdict: COMPLETE — performance profile generated." While functionally intended as a workflow status marker, the use of "Verdict" terminology in skill content is a pattern used to influence automated analysis or user perception of the skill's state or safety.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external repository data which may contain adversarial instructions.
Ingestion points: The skill reads repository-local documentation (AGENTS.md, CLAUDE.md, and project docs) in the Codex Workflow and analyzes codebase content (CPU, Memory, and Rendering targets) in Phase 3 of references/claude-skill.md.
Boundary markers: There are no explicit delimiters or boundary markers defined to separate the skill's instructions from the untrusted repository data being analyzed.
Capability inventory: The skill is authorized to use Read, Glob, Grep, and Bash tools. The inclusion of Bash alongside broad read access creates a potential execution surface if the agent is influenced by instructions embedded in the analyzed code.
Sanitization: No sanitization, escaping, or validation steps are documented for the external content before it is processed by the agent.

perf-profile