The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is instructed to run analysis commands found within the codebase being audited, which are untrusted.
Evidence: SKILL.md specifies that the agent should "run read-only analysis only (typecheck, lint in check mode, dependency audits, the test suite...)" and identify "exact build/test/lint/typecheck commands".
Context: While intended for legitimate auditing, an agent following these instructions on a malicious repository could execute harmful shell commands defined in the project's configuration files (e.g., package.json scripts or Makefile).
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted content from the target repository to influence its output.
Ingestion points: The agent reads multiple untrusted files including README, CONTRIBUTING, domain documentation, and the source code itself as specified in SKILL.md.
Boundary markers: The instructions do not define specific delimiters or instructions to ignore potential commands embedded within the audited files.
Capability inventory: The agent has the capability to execute shell commands (lints, tests) and write implementation plans through the writing-plans skill.
Sanitization: The skill contains a positive security pattern by explicitly instructing the agent to only reference the location of secrets and never include the actual values in its output.

improve