The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because its core function is to analyze untrusted source code from external repositories.
Ingestion points: Multiple agents (sast-entry-mapper, sast-danger-mapper, sast-flow-tracer, sast-gap-analyzer) are dispatched to read and analyze source code files from the directory path provided in the arguments (SKILL.md).
Boundary markers: The instructions do not define clear delimiters or "ignore embedded instructions" warnings when passing code content to the LLM-based agents, which could allow malicious code to manipulate the analysis results.
Capability inventory: The pipeline has access to the filesystem and can execute shell commands, build tools, and generated Proof of Concept code (SKILL.md).
Sanitization: No sanitization or filtering of the source code is specified before it is processed by the agents.
[COMMAND_EXECUTION]: The skill uses various shell commands for environment setup, language detection, and running analysis tools. This includes the use of find, ls, mkdir, and external binaries like cppcheck and semgrep (SKILL.md).
[EXTERNAL_DOWNLOADS]: For PHP projects, the skill may invoke composer install, which fetches external dependencies from the well-known Packagist registry (SKILL.md).
[REMOTE_CODE_EXECUTION]: During the PoC confirmation phase, the skill instructs agents to write and execute code (using ASan, PHP runtime, or language interpreters) to verify potential vulnerabilities. While this is the intended primary purpose of the skill, it involves the execution of code derived from an untrusted repository (SKILL.md).

sast