The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions in SKILL.md define specific workflows for auditing and designing developer-facing surfaces. The language is directive and strictly focused on its intended purpose without attempting to override agent safety protocols or bypass content guidelines.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to audit developer surfaces, which involves processing untrusted data from user repositories. This is a vulnerability surface inherent to the skill's purpose.
Ingestion points: Source code files, READMEs, and configuration files within the user's project directory (as defined in the SKILL.md workflow).
Boundary markers: No explicit delimiters or 'ignore' instructions are specified for separating user project content from the agent's core instructions.
Capability inventory: The skill uses standard file reading and text generation; it does not instructions the use of network or arbitrary command execution for its internal logic.
Sanitization: The instructions do not specify sanitization or escaping protocols for ingested repository content.
[DATA_EXPOSURE]: The evaluation fixtures included in the skill (e.g., evals/fixtures/sdk-quickstart/) contain sample code that demonstrates insecure practices like reading from a local configuration file (~/.quickpayrc) and using placeholder API keys. These are static artifacts used solely to verify the skill's auditing accuracy and do not pose a threat to the user environment.
[COMMAND_EXECUTION]: The SKILL.md and related reference materials mention CLI heuristics but do not instruct the agent to execute any dangerous shell commands. The evals/run-static-checks.sh script is a local utility for the skill author to verify the skill's integrity and does not run during normal agent operation.

dx