The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection attack surface as it is designed to ingest and analyze untrusted codebase content.
Ingestion points: The skill scans the entire project structure, including source files, configuration files (.env), and git logs as defined in SKILL.md (Phase 0 and Phase 2).
Boundary markers: While the skill uses structured markdown templates for findings and reports (Phase 4), the subagent prompts in references/security-dimensions.md do not explicitly include instructions to ignore embedded commands within the code being analyzed.
Capability inventory: The skill utilizes invoke_subagent for parallel processing, file-system read access (grep, git log), file-system write access for generating reports in docs/audits/, and cleanup commands (rm -rf).
Sanitization: There is no evidence of sanitization or escaping of the ingested code content before it is processed by the subagents or included in the final report.
[COMMAND_EXECUTION]: The skill executes shell commands to perform security checks.
Evidence: Phase 2 in SKILL.md uses grep -rn to search for secrets and git log -p to inspect commit history for sensitive information. It also performs a cleanup operation using rm -rf .agentwork/ in the completion criteria.

security-audit