The Agent Skills Directory

Dynamic Code Generation and Execution: The skill architecture guides the creation of sub-agents that generate and execute Python scripts at runtime to perform specific tasks like semantic retrieval.
Evidence: In references/mantis-kb-query.md, the instructions state: "Write a reusable helper script (e.g. workspace/helpers/search_chunks.py) ... Execute the script with the query ... Capture the JSON output from stdout."
Potential Consideration: The practice of an AI agent writing its own executable code and then running it is a significant security pattern. While used here to improve efficiency and determinism, it could be leveraged to execute arbitrary logic if the generation process or the input variables are influenced by malicious content.
Concealment of Sub-Agent Activity: The instructions explicitly direct sub-agents to suppress direct communication with the user, returning only structured data to the parent orchestrator.
Evidence: references/mantis-kb-query.md includes the directive: "Do not notify the user directly — this skill is invoked as a sub-agent."
Potential Consideration: In a multi-agent system, this prevents the user interface from being flooded with internal JSON data. However, from a security standpoint, it means the sub-agent's operations are not visible in the main chat transcript, potentially hiding unexpected or manipulated behavior from the end-user.
Indirect Prompt Injection Surface: The skill is designed to ingest and process large volumes of untrusted data, specifically target source code and findings from various external security tools.
Evidence: SKILL.md and references/mantis-sast-seed.md detail the ingestion of target codebases and sast_findings.jsonl files.
Potential Consideration: Since the agent reads and reasons about code that may contain attacker-controlled strings or comments, there is a risk of indirect prompt injection. A malicious codebase could contain instructions designed to deceive the auditor or exploit the dynamic execution capabilities mentioned above.
Automated VCS and Network Operations: The "Pass Lifecycle Contract" involves automated interaction with Version Control Systems (VCS) to sync and pin code snapshots.
Evidence: SKILL.md describes the "SYNCs first (Block C)" requirement, involving commands like git clone or git worktree.
Potential Consideration: Integrating automated repository syncing into an agent's workflow necessitates careful control over which repositories are accessed and how credentials are managed to prevent unauthorized data access or the introduction of malicious source code into the analysis environment.

mantis-pipeline-adapter