The Agent Skills Directory

[PROMPT_INJECTION]: The 'Overrides' section in the SKILL.md file instructs the agent to pay attention to specific instructions in the project's documentation or prompt files that may require bypassing the established security best practices. It explicitly tells the agent 'do not fight with' the user when these overrides are requested. This creates a vulnerability where a user or an attacker-controlled file could instruct the agent to disregard critical security protections.
[INDIRECT_PROMPT_INJECTION]: The skill's primary workflow involves the agent reading and analyzing all files within a user's repository. This creates an indirect prompt injection surface where malicious instructions hidden in the project's files (e.g., in documentation, comments, or configuration) could manipulate the agent's behavior, particularly given the explicit 'Overrides' instruction that encourages the agent to follow project-specific rules over its own security guidelines.
Ingestion points: The agent is directed to identify all languages and frameworks and read relevant documentation from the project's scope (Step 1 of the Workflow).
Boundary markers: There are no explicit instructions to use delimiters or ignore embedded instructions when reading the project files.
Capability inventory: The agent has the capability to write a security report (security_best_practices_report.md) and, more importantly, to modify the user's codebase to 'perform fixes'.
Sanitization: No sanitization or validation of the ingested project data is mentioned before the agent uses it to make decisions about code modifications.

security-best-practices