The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted metadata from user-supplied folders, which could contain malicious instructions designed to influence the agent's behavior when it reads the generated lint report.
Ingestion points: The scripts/lint_release.py script reads user-provided JSON, YAML, or key=value metadata files (e.g., metadata.json, release.yaml).
Boundary markers: The skill instructions do not mandate the use of delimiters or explicit "ignore embedded instructions" warnings in the generated markdown or JSON reports.
Capability inventory: The script performs file system reads and writes reports; the agent interprets the generated results to recommend next actions such as preparing a "Rights Passport."
Sanitization: While the script includes a denylist to avoid reading secret files, it does not sanitize or escape the content of metadata fields (like track titles or artist names) for prompt injection patterns before including them in the output.
[DATA_EXFILTRATION]: The skill implements strong safeguards against accidental data exposure or exfiltration by explicitly skipping sensitive files and directories.
Evidence: The scripts/lint_release.py file contains a robust denylist (DENY_DIR_NAMES, DENY_FILENAMES, DENY_SUFFIXES, SECRET_NAME_TOKENS) covering items such as .ssh, .aws, .env, and private keys.
Evidence: The is_denied_path function ensures these files are excluded from the inventory and analysis.
[EXTERNAL_DOWNLOADS]: The skill instructions mention installing a well-known third-party dependency from a standard registry.
Evidence: SKILL.md notes that PyYAML can be installed via python3 -m pip install PyYAML for YAML metadata support.
[SAFE]: The skill's primary analysis logic is contained in a local Python script that performs no network operations and uses safe parsing methods (e.g., yaml.safe_load()).

suede-release-linter