The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/validate.sh script implements a dynamic search routine to locate and execute an external Python utility (audit.py).
The script iterates through parent directories and common user-level configuration paths (e.g., ~/.codex and ~/.claude) to find a matching file.
Once located, it executes the script using python3 "$AUDIT" "$SKILL_DIR" "$@".
This dynamic loading from computed paths poses a security risk, as it could result in the execution of arbitrary malicious code if such a file is placed in any of the searched locations.
[PROMPT_INJECTION]: The skill's primary operation involves processing untrusted external content, making it vulnerable to indirect prompt injection attacks.
Ingestion points: The agent is instructed to "Discover" and "Read key files fully" from target codebases as described in references/procedure.md (Step 2).
Boundary markers: The instructions lack markers or specific warnings to the agent to treat the ingested code as untrusted data or to ignore embedded instructions.
Capability inventory: The agent has access to powerful tools, including Bash, Write, and Edit, which could be exploited if malicious code in the target harness hijacks the agent's logic.
Sanitization: No sanitization or validation logic is applied to the codebase content before it is read into the agent's context for scoring.

agentharness-audit