The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill utilizes external tools to fetch security research which introduces untrusted data into the agent's context.
Ingestion points: The skill uses Firecrawl in SKILL.md to retrieve current OWASP and Supabase security patterns from the internet.
Boundary markers: Absent. The instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings for the data fetched via Firecrawl.
Capability inventory: The skill possesses the capability to read project source code, scan .env files, execute npm audit, and interact with database metadata via the Supabase MCP.
Sanitization: Absent. There is no mention of escaping, filtering, or validating the external content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill instructions specify the direct execution of system-level audit tools.
Evidence: SKILL.md states that npm audit and secret scans using grep patterns are 'run exactly' during the audit process.
[PROMPT_INJECTION]: The skill uses specific directives to control agent behavior, though these are focused on safety enforcement rather than bypasses.
Evidence: The 'Preservation Contract' in references/preservation-contract.md requires a mandatory acknowledgement and imposes strict constraints on the agent's actions, such as forbidding destructive testing and the output of secret values.

plan-security-audit