The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted content from external code files and possesses the capabilities to modify the filesystem.
Ingestion points: Target files specified in $ARGUMENTS or identified via git diff commands are read into the agent's context.
Boundary markers: Absent. The instructions do not specify any delimiters or warnings to ignore instructions that might be embedded within the files being cleaned.
Capability inventory: The skill utilizes Read, Edit, and Write tools, enabling it to alter file content based on instructions found during the processing of source code.
Sanitization: No sanitization or filtering logic is provided to prevent the agent from obeying instructions hidden in comments or strings within the code being processed.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the git tool (e.g., git diff --name-only HEAD) to identify files for processing. While these commands are limited to repository metadata and are standard for development workflows, they involve executing logic based on the local environment's state.

deslop