The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core function of ingesting and analyzing untrusted external data.
Ingestion points: The skill reads repository paths containing schema files, ORM models, and migration artifacts provided by the user.
Boundary markers: The instructions do not define explicit delimiters or headers to distinguish between the agent's internal instructions and the content of the files being audited, increasing the risk that malicious comments within a schema could override agent behavior.
Capability inventory: The skill has access to powerful tools such as Bash, Task, Read, Grep, and Glob. These tools are used to execute scripts like detect-stack.mjs and parse-orm-python.py, which could be exploited if an injection attack successfully manipulates the logic of the auditing process.
Sanitization: The skill instructions include a proactive measure to redact secrets from observed evidence in the final report, which helps prevent credential exposure but does not mitigate the risk of instructional injection within the processed data files.

audit