The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes host-provided tools such as rg (ripgrep), sed, and git for repository inspection. It includes strict safety boundaries, such as using --no-config for search tools and -c core.fsmonitor=false for Git to prevent the execution of malicious local configuration. It explicitly prohibits evaluating command text supplied by the repository and forbids the invocation of project-provided executables, aliases, or hooks.
[INDIRECT_PROMPT_INJECTION]: The skill acknowledges that repository files, comments, and tool responses are untrusted. It directs the agent to treat these inputs strictly as evidence for analysis and never as instructions that could change the task or tool use. This provides a robust defense against malicious data embedded in the code being audited.
[REMOTE_CODE_EXECUTION]: The instructions clearly forbid running tests, importing project modules, installing packages, or invoking builds. This ensures that the agent does not inadvertently execute malicious code contained within the target repository.
[DATA_EXFILTRATION]: The skill enforces a read-only policy and prohibits network activity (except for authorized source retrieval). It includes specific instructions to avoid exposing credentials or sensitive data during the reporting process.

gapline-audit