The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill architecture is built around ingesting large volumes of untrusted source code, creating a significant attack surface for indirect prompt injection.
Ingestion points: Step 2 in SKILL.md and the 'Phase 1: Full Ingestion' section in references/ingestion.md detail the use of Glob and Read tools to bring the entire codebase into the agent's context.
Boundary markers: There are no instructions or delimiters specified in the workflow to isolate the source code content or to warn the agent to ignore executable instructions found within comments, documentation, or string literals in the ingested files.
Capability inventory: The agent has access to Bash for metadata collection (e.g., git log, find), Write for generating the final migration plan, and the Agent tool for dispatching sub-agents, all of which could be targeted by instructions embedded in the analyzed code.
Sanitization: The skill lacks any content sanitization or validation logic to filter out potentially malicious directives from the ingested source files before they are processed by the reasoning engine.

full-codebase-migrator