The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and processes untrusted data from the repository to answer user queries.
Ingestion points: Untrusted source code files (src/**) and repository documentation (.repo-wiki/) are read and synthesized into answers.
Boundary markers: The skill does not explicitly instruct the agent to use delimiters or ignore instructions embedded within the source code or wiki pages during the synthesis process.
Capability inventory: The skill allows reading any file in the repository (within a verification budget) and writing markdown files to specific subdirectories (.repo-wiki/syntheses/, .repo-wiki/log.md).
Sanitization: There are no defined procedures for escaping or validating the content of the repository files before they are presented to the agent for analysis.
[SAFE]: The skill implements a verification budget formula (max(1, min(10, ceil(0.05 × total_paths)))) that limits the number of files the agent can read, preventing denial-of-service or excessive resource consumption during verification.
[SAFE]: File writing operations are logically restricted to the .repo-wiki/ directory for legitimate logging and synthesis storage, with no evidence of arbitrary file write capabilities or directory traversal attempts.

query