The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted source code as its primary function, creating a potential surface for indirect prompt injection where malicious instructions embedded in scanned files could attempt to influence agent behavior.
Ingestion points: The scripts scripts/codeql_scan.py and scripts/semgrep_scan.py read file contents using Path.rglob and open() to process files in the scan target directory.
Boundary markers: The current implementation lacks explicit boundary markers or instructions to the agent to disregard natural language instructions found within the code files being scanned.
Capability inventory: The skill is granted significant permissions including Read, Write, Edit, and scoped Bash execution (security:*, scan:*, audit:*), which could be leveraged if an injection is successful.
Sanitization: No sanitization or filtering is performed on the content of the files before they are read and analyzed by the agent context.

scanning-input-validation-practices