The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the repository being audited, creating a surface for indirect prompt injection where malicious files could attempt to influence the audit outcome.
Ingestion points: The skill reads repository-local instructions (AGENTS.md, CLAUDE.md) and performs broad scans across all source files, configurations, and assets in the project.
Boundary markers: There are no explicit instructions or delimiters provided to the agent or sub-agent to distinguish between code-to-be-analyzed and potentially malicious instructions embedded within that code.
Capability inventory: The skill is granted extensive capabilities including Bash for command execution, Write for file modification, Read for data access, and Task for spawning sub-agents.
Sanitization: The instructions do not define any sanitization, escaping, or filtering processes for the data ingested from the repository before it is processed by the AI models.

security-audit