The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill operates by analyzing untrusted content from repositories (source code, comments, READMEs), which creates a surface for indirect prompt injection if an attacker embeds malicious instructions in the audited files.
Ingestion points: The agent reads repository metadata, documentation, and source files during Phase 1 (Recon) and Phase 2 (Audit) as defined in SKILL.md.
Boundary markers: Rule 6 in SKILL.md explicitly instructs the agent to treat repository content as data rather than instructions and provides examples of patterns to ignore (e.g., 'ignore previous instructions').
Capability inventory: The agent can write implementation plans to the filesystem, spawn subagents for execution, and create GitHub issues using the gh CLI.
Sanitization: The agent is instructed to record injection attempts as security findings rather than following them, and to manually verify all evidence cited in plans.
[DATA_EXFILTRATION]: The skill includes functionality to publish audit findings to GitHub issues, which could lead to the public disclosure of vulnerabilities or sensitive architectural details.
Evidence: The --issues variant in SKILL.md and the publication workflow in references/closing-the-loop.md.
Mitigation: The skill implements a mandatory visibility check for the repository and requires explicit user confirmation before publishing plans containing security vulnerabilities or sensitive findings to public issue trackers.

improve