The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process untrusted data from a third-party repository to generate architecture and handoff documentation, creating an attack surface for indirect prompt injection.
Ingestion points: In SKILL.md (Phases 0 through 5), the agent is instructed to scan various files, including manifests, source code for route definitions, and database models.
Boundary markers: There are no explicit instructions or delimiters defined to prevent the agent from following instructions embedded within the codebase being scanned.
Capability inventory: The skill writes a local HTML file (docs/architecture/handoff.html) and directs the agent to open the generated file in a browser.
Sanitization: The process relies on the agent to extract facts without sanitizing the content interpolated into the template.html slots. A malicious repository could contain crafted comments designed to influence the agent's summary or inject content into the final document.
[EXTERNAL_DOWNLOADS]: The generated documentation relies on external resources from well-known technology services.
The references/template.html file loads the Mermaid.js library from https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.esm.min.mjs via a script tag.
The references/mermaid-guide.md instructs the agent to embed brand logos using the Iconify API (https://api.iconify.design/logos/) within the architecture diagrams.

codebase-handoff