The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's instructions explicitly direct the agent to execute code from the target repository being graded. Specifically, it commands the agent to 'Run what the repo already ships' to verify quality gates, including executing 'the typecheck, the configured linter on changed files, the test suite, and, for a release grade, the production build.' Since these scripts originate from the repository being analyzed—which may be untrusted—this pattern constitutes a risk of executing arbitrary and potentially malicious code in the agent's environment.
[INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting and processing untrusted data (the source code and configuration files of a repository) and using that data to determine which commands to execute, creating an attack surface for indirect prompt injection.
Ingestion points: The agent is instructed to read 'diff, changed files, generated files, and touched routes or APIs; imports, callers, schemas, configs, env requirements, jobs, webhooks, scripts, tests, and docs' from the target repository (SKILL.md).
Boundary markers: There are no instructions provided to the agent to treat instructions or content found within the ingested repository files as untrusted or to ignore embedded directives that might attempt to hijack the grading process or host environment.
Capability inventory: Across its instructions, the skill leverages the agent's ability to execute shell commands for building, testing, and linting activities (SKILL.md, references/worked-example.md).
Sanitization: The skill does not define sanitization or sandboxing requirements for the commands it executes from the analyzed repository, though it does include logic to detect common security flaws within the code it is reviewing.

suede-code-grader