The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and analyzes content from arbitrary external codebases.
Ingestion points: As defined in references/investigation-protocol.md, the skill reads project documentation (README.md, CONTRIBUTING.md), source code files, and git history from potentially untrusted repositories.
Boundary markers: There are no specific instructions or delimiters provided to the agent to treat the analyzed code as data rather than instructions, nor are there warnings to ignore embedded directives.
Capability inventory: The skill possesses powerful capabilities including Bash execution, file reading, and the ability to write reports to the local filesystem.
Sanitization: The instructions do not specify any sanitization or filtering of the content read from the target codebase before it is processed by the model.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to perform various repository analysis tasks.
Evidence: references/investigation-protocol.md instructs the use of find, wc, git log, and git shortlog to gather metrics on line counts, contributor history, and repository age. While these are appropriate for the skill's stated purpose, they represent a significant capability that could be targeted for exploitation if the agent is misled by injected instructions.

tech-due-diligence