The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests arbitrary files from a codebase (e.g., source code, CLAUDE.md, architecture notes) and incorporates them into prompts for specialized LLM subagents without sanitization or strict boundary delimiters.
Ingestion points: SKILL.md (Step 3) specifies that each lens receives codebase content and project conventions such as CLAUDE.md and AGENTS.md.
Boundary markers: The instructions do not specify the use of delimiters or "ignore embedded instructions" warnings when interpolating codebase content into lens prompts.
Capability inventory: The agent has the ability to execute shell commands (Step 2), read files, and perform network requests via npx.
Sanitization: No sanitization or validation of the ingested repository content is mentioned before it is processed by the lenses.
[COMMAND_EXECUTION]: The "Mechanical pass" (Step 2) involves executing build, typecheck, lint, and test scripts defined within the repository being audited (e.g., scripts found in package.json). This pattern allows for the execution of arbitrary code provided by the target repository.
[EXTERNAL_DOWNLOADS]: The skill suggests running third-party scanners via npx if the project lacks configured tooling. While the skill requires user confirmation before proceeding, this involves downloading and executing external packages from remote registries.

survey