The Agent Skills Directory

[PROMPT_INJECTION]: The skill explicitly instructs the agent to operate with high autonomy and bypass user oversight. SKILL.md contains directives such as "Run autonomously. Never ask the user for input" and "run to completion without questions or confirmation". This overrides the default interactive safety model designed to prevent unintended actions.- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from the repository being audited, which creates a significant indirect injection surface.
Ingestion points: The agent reads the entire codebase using Read, Grep, and Glob tools as defined in Phase 1 and Phase 2 of the workflow.
Boundary markers: The instructions for sub-agents (e.g., in references/agent-security.md) direct the commander to "paste full reconnaissance report here" inline without using XML tags, delimiters, or "ignore embedded instructions" warnings. This allows content from the audited files to potentially influence the instructions given to the audit agents.
Capability inventory: The skill has access to the Bash tool, the Write tool for disk access, and the Agent tool to spawn sub-processes.
Sanitization: There are no instructions or mechanisms provided to sanitize or escape content read from files before it is interpolated into sub-agent prompts.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to run repository analysis commands. Specifically, references/agent-dependency.md instructs the agent to run audit tools like npm audit, pip audit, cargo audit, and govulncheck based on the detected project environment.
[EXTERNAL_DOWNLOADS]: The instructions in references/agent-dependency.md suggest the agent should "install if needed" tools such as safety check. This implies the dynamic installation of external packages at runtime, which can introduce supply chain risks if the package manager installs unpinned or malicious versions from public registries.

overnight-repo-auditor