The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data by analyzing external repository files, code diffs, and pull requests. This creates a theoretical vulnerability where malicious instructions hidden within comments, strings, or documentation in the analyzed code could attempt to override the agent's instructions or influence its findings.
Ingestion points: As described in SKILL.md, the skill reads content from the current working tree, specific paths, and git comparisons (diffs/PRs).
Boundary markers: The instructions do not define explicit delimiters or 'ignore' directives to protect the agent from embedded instructions within the code it reviews.
Capability inventory: The skill is authorized to perform file writes ('Apply the fixes') and execute shell commands ('run the narrowest checks needed') if the user provides authorization.
Sanitization: No sanitization or pre-filtering of the ingested source code is mentioned in the instructions.
[COMMAND_EXECUTION]: The skill enables the agent to execute system commands to verify its findings or validate code fixes. Although the instructions advise the agent to 'inspect scripts before execution,' this capability could be exploited if the agent is tricked into executing malicious scripts present within the reviewed codebase.

simplify