The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions provide a shell command template (find $ARGUMENTS ...) for the agent to execute using the Bash tool. The direct interpolation of the $ARGUMENTS variable without explicit sanitization or validation instructions creates a command injection risk. A malicious user providing an argument such as ; malicious_command could lead the agent to execute arbitrary shell commands on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill identifies a significant attack surface for indirect prompt injection, which could allow maliciously crafted code files to manipulate the agent.
Ingestion points: The skill reads external .swift files discovered via the find command or specified by the user.
Boundary markers: The instructions lack specific delimiters or warnings for the agent to ignore instructions embedded within the files being audited (e.g., in comments).
Capability inventory: The agent is granted Bash, Edit, and Read tools, providing it the ability to execute code and modify the filesystem based on its analysis.
Sanitization: No sanitization or validation of the external file content is required before processing. A malicious actor could place hidden instructions in a Swift file (e.g., inside a comment) that, when read by the agent, could trick it into performing unauthorized file modifications or executing arbitrary bash commands.

swift-clean-review