The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's instructions define a workflow that reads and analyzes arbitrary codebase files (ingestion points in SKILL.md Phases 1 and 5). This processing of untrusted data creates a surface for indirect prompt injection, where malicious instructions embedded in a target codebase could attempt to influence the agent's audit report or behavior.\n
Ingestion points: The agent is instructed to read every line of in-scope code in a repository (SKILL.md).\n
Boundary markers: The instructions lack explicit delimitation or safety markers to prevent instructions within the audited code from being interpreted as agent commands.\n
Capability inventory: The agent has the capability to read project files and write a report file at the project root (SKILL.md).\n
Sanitization: There are no explicit sanitization or filtering steps mentioned for the untrusted code being audited.\n- [SAFE]: Automated scanner alerts identified phishing-style URLs (e.g., userinfo confusion examples) and unsafe code injection patterns (e.g., eval in references/language-footguns/python.md). Technical analysis confirms these are non-malicious educational placeholders and descriptive warnings within the skill's security checklists and language-specific reference guides intended to assist the agent in detecting vulnerabilities during a codebase audit.

security-audit