The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The SKILL.md instructions include an "Overrides" section that explicitly tells the agent to "bypass or override" security practices if requested by project documentation or prompt files, and instructs the agent "do not fight with them." This creates an attack surface where an attacker can embed malicious instructions in a codebase to trick the agent into suggesting or implementing insecure code.
Ingestion points: The skill processes user codebase files and project documentation (untrusted data) in SKILL.md.
Boundary markers: There are no instructions for the agent to distinguish between code and data, or to ignore embedded instructions in the reviewed files.
Capability inventory: The agent has the ability to read project files, write new report files, and modify existing source code to apply "fixes."
Sanitization: No sanitization is performed on the instructions found within the user-provided code that are allowed to override the security spec.
[METADATA_POISONING]: The SKILL.md frontmatter lists the author as "OpenAI," which is inconsistent with the provided developer context indicating "jetbrains" as the author. Such discrepancies can lead to confusion regarding the skill's origin and safety.

security-best-practices