The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's codebase audit methodology (Phase 0) instructs the agent to clone external GitHub repositories using the command git clone https://github.com/<owner>/<repo>.git. This allows for the download of arbitrary, untrusted code into the agent's working environment based on user input.
[COMMAND_EXECUTION]: The skill methodology utilizes shell commands such as find, ls, and cat to inspect the directory structure and file contents of cloned repositories. These commands are executed against untrusted external data during the discovery and mapping phases.
[PROMPT_INJECTION]: The audit process specifically directs the agent to read project documentation and instructions files like AGENTS.md and SKILL.md from cloned repositories. This creates a vector for indirect prompt injection, where an attacker-controlled repository could contain malicious instructions designed to subvert the planning agent's logic or safety boundaries.
[INDIRECT_PROMPT_INJECTION]: As a planning tool that ingests external data, the skill has a clear attack surface for indirect injection.
Ingestion points: Cloned repository files including README.md, AGENTS.md, and SKILL.md (referenced in references/codebase-audit-methodology.md).
Boundary markers: None identified in the provided instructions to distinguish between the agent's core rules and instructions found in audited data.
Capability inventory: Subprocess calls for git clone, find, ls, and cat (referenced in references/codebase-audit-methodology.md).
Sanitization: None identified; the agent is instructed to read and map functional capabilities directly from source files.

execution-grade-planning