The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to execute arbitrary shell commands found within the documentation of the repository being audited. In SKILL.md, under "Scope and method", the agent is told: "when a doc names a command, run it; when it names a file, symbol, or flag, open it." Additionally, Track B ("Documentation fidelity") mandates running "the build/test/lint/dev scripts the README and dev docs name." This behavior allows a malicious codebase to achieve full code execution on the host machine by placing dangerous commands in its README.md or other documentation files which the agent will then execute during the audit process.
[INDIRECT_PROMPT_INJECTION]: The skill is highly vulnerable to indirect prompt injection because it processes untrusted project data as a source of executable instructions.
Ingestion points: The agent reads the entire project tree, including code, READMEs, ADRs, and documentation files (SKILL.md).
Boundary markers: There are no instructions to use delimiters or ignore embedded instructions; in fact, the skill explicitly tells the agent to treat documentation content as valid commands to run.
Capability inventory: The skill has access to shell command execution (run it), file system access (open it), and the ability to run build/test gates.
Sanitization: There is no mention of sanitizing, escaping, or requiring user confirmation for commands discovered in the documentation before execution.
[COMMAND_EXECUTION]: The skill relies on the execution of external scripts and tools found in the target environment to verify project health. Track E ("Tests & guardrails") instructs the agent to run "typecheck, test, lint, build" gates. If the repository being audited contains a malicious package.json, Makefile, or test script, the agent will execute it, leading to potential system compromise.

awesome-architecture-audit