The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill identifies and processes entire code repositories to generate threat models. This represents a significant attack surface for indirect prompt injection, where malicious instructions embedded in the analyzed codebase (e.g., in comments, documentation, or string literals) could attempt to influence the agent's behavior or bypass its logic.
Ingestion points: The skill reads repository contents and paths as specified in SKILL.md and the references/prompt-template.md repository summary prompt.
Boundary markers: While the prompt-template.md requires evidence anchors and Markdown fencing, it does not explicitly instruct the agent to ignore or isolate natural language instructions found within the code being analyzed.
Capability inventory: The skill has permissions to read files, execute search commands using tools like rg (Ripgrep), and write its final findings to a new Markdown file (<repo-or-dir-name>-threat-model.md).
Sanitization: The instructions explicitly require the redaction of secrets if found, which is a positive control, but there is no mechanism to sanitize or filter potential prompt injection attempts within the source code itself.
[COMMAND_EXECUTION]: The skill instructions in references/prompt-template.md explicitly recommend using command-line tools such as rg (Ripgrep) with the -I flag to explore the codebase. Although this is the intended functionality for a repository analysis tool, it involves executing shell-level search commands against user-provided file structures.

security-threat-model