The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted source code provided by users, which creates a vulnerability surface for indirect prompt injection attacks where malicious code could influence the agent's behavior during the review process.
Ingestion points: External project source files and dependency manifests identified in the instructions within SKILL.md.
Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded commands within the analyzed code.
Capability inventory: The skill is granted Bash(cmd:*), Read, Write, and Edit tools, allowing for significant system interaction based on the analysis results.
Sanitization: No sanitization or validation of the input source code is performed before processing.
[DYNAMIC_EXECUTION]: The file assets/example_code_vulnerable.py includes a demonstration of insecure deserialization using the pickle.loads() function. This code is intended for educational purposes but contains a payload that attempts to execute destructive system commands (rm -rf /) if deserialized.
[COMMAND_EXECUTION]: The file assets/example_code_vulnerable.py contains a demonstration of command injection using subprocess.run() with shell=True. While provided as a negative example for security testing, it represents a pattern that executes arbitrary shell strings.

performing-security-code-review