The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and analyze untrusted content from a codebase (READMEs, configuration files, source code). This creates a surface for malicious instructions within those files to influence the agent's logic.\n
Ingestion points: Phase 1 and 2 in SKILL.md involve reading root configuration files (e.g., package.json, .env), directory trees, and source code files.\n
Boundary markers: There are no explicit delimiters or instructions provided to the agent to distinguish between code-as-data and code-as-instructions, increasing the risk of the LLM following embedded prompts.\n
Capability inventory: The agent has the ability to execute shell commands (git, gh), spawn subagents, and write to the local file system (in the plans/ directory).\n
Sanitization: While Phase 3 includes a confirmation step where the agent re-reads cited code, this acts as a verification of evidence rather than a filter for malicious instructions.\n- [COMMAND_EXECUTION]: The skill utilizes several CLI tools to perform its audit and reporting functions.\n
Evidence: The instructions in SKILL.md direct the agent to use git (log, diff, rev-parse), gh (issue create), and various language-specific tools like npm audit or tsc --noEmit.\n
Context: These commands are used for read-only analysis or reporting (creating GitHub issues), which is consistent with the skill's purpose, but they provide a mechanism for data to leave the local environment.\n- [DYNAMIC_EXECUTION]: The skill uses subagents to handle complex or parallel tasks.\n
Evidence: SKILL.md describes fanning out to parallel read-only subagents for audits and dispatching an executor subagent for the execute variant.\n
Risk: If the main agent's context is poisoned via indirect injection, it could pass malicious instructions to these subagents, extending the impact of the attack.\n- [DATA_EXFILTRATION]: The skill is designed to search for and identify sensitive information as part of its security audit lens.\n
Evidence: Phase 2 explicitly includes searching for secrets in code or logs. Although the skill mandates that it Never reproduce secret values, the agent must still read and process these values, exposing them to the LLM's internal context and potentially to external logging or subagents.

hl-improve