The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it is designed to ingest and process untrusted data from the user's codebase.
Ingestion points: The process in SKILL.md instructs the agent to read CONTEXT.md, docs/adr/, and use an Explore subagent to walk the codebase and entry points.
Boundary markers: The instructions lack explicit boundary markers or warnings to disregard potential natural language instructions embedded within comments or documentation in the audited codebase.
Capability inventory: The skill utilizes an Agent tool to spawn sub-agents and has the capability to write or update documentation files like CONTEXT.md based on its findings.
Sanitization: There is no evidence of sanitization, filtering, or validation of the content read from the codebase before it is used to inform the audit and subsequent design discussions.

deep-codebase-audit