The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill clones and inspects untrusted external GitHub repositories, presenting snippets and metadata to the agent. A malicious repository could attempt to influence agent behavior through crafted instructions in code comments or project documentation. Ingestion points: scripts/search-context.mjs reads and processes file contents from cloned repositories using ripgrep. Boundary markers: The output is structured in a Markdown manifest with distinct headers and instructions for the agent. Capability inventory: The skill uses spawnSync to execute gh, git, and rg for repository management and inspection. Sanitization: The script uses a restrictive regex for search terms, compacts whitespace, and trims snippets before including them in the manifest.
[COMMAND_EXECUTION]: The script executes system commands (gh, git, rg) using Node.js spawnSync. Evidence: Found in the runCommand function in scripts/search-context.mjs. Mitigation: Commands are executed with argument arrays (no shell), and user input used in search phrases is filtered through a restrictive regex (/[a-z0-9+#.]+/gi), preventing shell metacharacter injection.
[EXTERNAL_DOWNLOADS]: The skill performs repository discovery and cloning from GitHub. Evidence: scripts/search-context.mjs uses gh api for discovery and git clone for retrieval. Security Context: This is an intended primary function. The skill includes explicit security guidelines in SKILL.md and references/security.md prohibiting the execution of any downloaded code or installation of dependencies.

search-context