The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted files from external skill directories or git repositories, creating a surface where malicious instructions in the audited content could attempt to influence the agent's reporting behavior.\n
Ingestion points: The scripts/skill_security_auditor.py script reads the contents of all markdown and code files within a target directory specified by the user via the rglob and read_text methods.\n
Boundary markers: The skill instructions in SKILL.md define a strict report format with a PASS / WARN / FAIL verdict, which helps constrain the agent's response logic when encountering malicious content during an audit.\n
Capability inventory: The skill utilizes subprocess.run to execute git clone for remote repository auditing and performs local file system read operations to analyze code and metadata.\n
Sanitization: The auditor relies on static regex-based pattern matching (defined in CODE_PATTERNS and PROMPT_INJECTION_PATTERNS) to evaluate content rather than dynamic execution or interpretation, which mitigates the risk of the agent inadvertently following instructions contained within audited files.

skill-security-auditor