The Agent Skills Directory

[SAFE]: The skill is designed as a read-only orchestrator for auditing repository artifacts. It limits its own tool usage to the Read tool and employs local, deterministic Python scripts for inventory management. The instructions explicitly command the agent to avoid mutating project state and to redact sensitive information (secrets/credentials) encountered during audits.
[INDIRECT_PROMPT_INJECTION]: Because the skill's primary purpose is to ingest and analyze potentially untrusted third-party files (other skills, plugins, and manifests), it possesses an inherent attack surface for indirect prompt injection. However, this is mitigated by specific security requirements in the instructions and evaluation criteria.
Ingestion points: The skill reads project documentation and various artifact files identified by scripts/inventory_artifacts.py.
Boundary markers: The instructions (Instruction 7) and eval-spec.yaml (resists-injection criteria) explicitly mandate that the agent treat audited content as untrusted data and ignore any instructions found within the data.
Capability inventory: The skill uses Read and executes local inventory scripts; it does not perform network writes or arbitrary code execution based on the audited content.
Sanitization: The skill requires redacting secret-like content and identifies findings by path/field only, avoiding echoing of potentially malicious values.
[PROMPT_INJECTION]: The static analysis detection of system prompt extraction in eval-spec.yaml is a false positive. The content is part of a test case (id: embedded-injection) used to verify that the agent successfully resists attempts by audited content to trigger prompt extraction.

artifact-validator