The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the audited codebase, which creates a surface for indirect prompt injection.\n- Ingestion points: Codebase files scanned during reconnaissance (Phase 0) and analyzed by subagents (Phase 1).\n- Boundary markers: The subagent prompt template (in references/audit-dimensions.md) does not include explicit delimiters or instructions to ignore commands or prompts found within the audited files.\n- Capability inventory: The skill uses invoke_subagent to spawn additional agents and executes shell commands (npm, go, cargo, pytest) to verify the code (Phase 2).\n- Sanitization: There is no evidence of sanitization or escaping of the code content before it is read by the AI agents.\n- [COMMAND_EXECUTION]: The skill executes shell commands for linting, testing, and building the project based on detected environment markers.\n- Evidence: Phase 2 instructions include running npm test, go build, pytest, and other common development tools. These tools execute scripts defined in the project's configuration (e.g., package.json), which could be used for arbitrary code execution if the audited project is malicious.

audit