The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection because it programmatically fetches and processes untrusted content from external GitHub repositories and documentation websites.
Ingestion points: The skill uses mcp__zread__read_file to ingest source code and mcp__web-reader__webReader to fetch documentation (see Workflows/01-discover.md and Workflows/02-analyze.md).
Boundary markers: Absent. The prompt template used to invoke background agents in Workflows/02-analyze.md (Step 2) lacks delimiters (like XML tags or triple quotes) and specific instructions to ignore malicious directives embedded within the source files.
Capability inventory: The skill has access to WebSearch, WebFetch, Write, and Edit tools, which could be abused if an injected instruction successfully hijacked the agent's intent.
Sanitization: No sanitization, escaping, or validation of the fetched external content is performed before it is passed into the LLM context for analysis.

source-dive