The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local codebase (e.g., README files, PRDs, and source code) to populate its documentation templates. This presents a surface for indirect prompt injection where malicious instructions embedded in project files could attempt to influence the agent's output.
Ingestion points: SKILL.md Phase 1 and Phase 2 require the agent to read various documentation and source files; scripts/scan.py reads manifest files and searches for TODO/FIXME comments across the repository.
Boundary markers: Absent; the skill relies on the agent's instructions to trace claims to source files and terminal output rather than using technical delimiters.
Capability inventory: The skill allows the agent to write files to the local docs/codebase/ directory and execute the bundled scripts/scan.py script.
Sanitization: No explicit sanitization or instruction-filtering is applied to the content read from the codebase.
[COMMAND_EXECUTION]: The skill executes a bundled Python script and standard git commands to perform repository discovery and metrics collection.
Evidence: SKILL.md Phase 1 instructs the agent to run python3 "$SKILL_ROOT/scripts/scan.py". The script itself utilizes subprocess.run() to execute git log and git rev-parse. These commands are used for local reconnaissance (e.g., detecting high-churn files and recent commits) and do not involve network operations or arbitrary shell execution.

acquire-codebase-knowledge