The Agent Skills Directory

[Indirect Prompt Injection Surface]: The skill orchestrates subagents using results from previous analysis stages stored in workspace/findings/ and learnings.jsonl. This creates a potential surface for indirect prompt injection where untrusted data from an analyzed target could influence the instructions passed to subagents. Evidence: (1) Ingestion points: workspace/findings/*.json and learnings.jsonl are read in Stage 13 and 15; (2) Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present; (3) Capability inventory: The agent can move files, create directories, and invoke subagents; (4) Sanitization: There is no evidence of filtering or validation of the ingested finding descriptions.
[Automated File Management]: The orchestrator utilizes shell commands such as mkdir and mv to manage pass-specific results and maintain the state of the continuous review loop (Stage 15). These capabilities are necessary for the skill's long-running orchestration logic but represent direct manipulation of the workspace environment.
[Security Tooling Authorization]: The instructions explicitly authorize the use of various binary analysis and emulation tools like radare2, Ghidra, and qemu on raw binaries and firmware. While this is standard for the skill's stated purpose of automated vulnerability research, it involves processing untrusted artifacts with powerful diagnostic tools.

mantis-meta-agent