The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands for project reconnaissance and verification. In sweep-guide.md (Step 0a), it estimates file counts using git ls-files or find. In Step 2e, it executes test runners like npm test, pytest, cargo test, or go test. These commands are often defined by the project's own configuration files (e.g., package.json), which could lead to the execution of malicious scripts if the project being scanned is untrusted.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface where malicious content in the scanned codebase could influence the agent's automated remediation actions.
Ingestion points: Codebase files within the project scope (Steps 2-5) and the .brooks-lint.yaml configuration file (Step 1b).
Boundary markers: The instructions do not define delimiters or "ignore embedded instructions" warnings to separate untrusted codebase content from the agent's logic.
Capability inventory: The skill performs file modifications (Edit or Write in Step 2d) and executes shell commands (test runners in Step 2e).
Sanitization: There is no evidence of sanitization or validation of the ingested code content before it influences the agent's remediation decisions.
[DYNAMIC_EXECUTION]: The skill creates an autonomous feedback loop where it modifies local source code and then executes that code via the project's test suite to verify the changes. This cycle of modification and execution represents a powerful capability that could be exploited if the codebase contains adversarial patterns designed to subvert the analysis logic.

brooks-sweep