The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a Python script (utilities/skill-builder/scripts/record_skill_feedback.py) to record decisions. This script is not included in the provided files, and its behavior cannot be verified. Additionally, the execution takes variable arguments like '--notes' which could be manipulated for command injection if user-influenced data is included.
[PROMPT_INJECTION]: The skill is subject to indirect prompt injection because its core purpose is to ingest and process untrusted user-provided codebases. Ingestion points: Target codebase, file scope, or feature area as defined in SKILL.md. Boundary markers: Absent; the instructions do not specify the use of delimiters or 'ignore' instructions for the processed code. Capability inventory: The skill can write files (security reports) and execute shell commands (feedback recording script). Sanitization: Absent; the workflow does not include instructions for sanitizing or escaping the user-provided code before processing.
[PROMPT_INJECTION]: The reference materials use deceptive metadata, citing framework versions (e.g., Next.js 16.1, Go 1.25, Django 6.0) and security advisories (e.g., CVE-2025-66478) dated to the year 2026. This misleading information could lead the agent to provide speculative or inaccurate security advice.

security-best-practices