The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and analyzes untrusted content from the user's codebase (source files, templates, styles, and configs). This content is processed by multiple agents to identify 'AI slop' and 'code smells', which could be manipulated by malicious code to influence agent behavior.
Ingestion points: All files within the user-specified directory are read and processed by the scanner agents.
Boundary markers: The skill does not implement delimiters or clear instructions to ignore instructions embedded within the target codebase files.
Capability inventory: The skill utilizes the Bash tool for refactoring and file system operations, and executes external commands.
Sanitization: No explicit sanitization or escaping of untrusted file content before processing.
[DYNAMIC_EXECUTION]: The validation-agent is designed to execute shell commands that run the project's own test suites and build scripts.
Evidence: Instructions in agents/validation-agent.md direct the agent to run commands such as bun test, npm test, pytest, and bun run build.
Risk: These commands trigger execution of scripts defined in the target project's configuration (e.g., package.json), which could lead to arbitrary command execution if the project is untrusted.
[COMMAND_EXECUTION]: The skill relies on the Bash tool to perform its primary functions, including refactoring and validation.
Evidence: SKILL.md lists Bash as an allowed tool, and various agent roles describe using it to apply fixes and run automated checks.

code-cleanup