The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes several standard command-line tools to perform its auditing and reporting functions. These include git for repository metadata, gh for interacting with GitHub (requires user-authorized flag), and various development tools like pytest, ruff, and pip-audit for code analysis. These operations are consistent with the skill's stated purpose of auditing a codebase.
[DATA_EXFILTRATION]: While the skill can create GitHub issues using the gh CLI, this behavior is gated behind a specific user-provided flag (--issues) and utilizes a well-known service. The skill instructions also contain explicit rules to prevent the exposure of secrets, directing the agent to reference the location of a secret rather than its value.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection because its primary function is to read and analyze arbitrary codebase content. An attacker could place malicious instructions within code comments or documentation intended to influence the agent's findings or the specifications it generates.
Ingestion points: Reads all files within a target repository during the Recon and Audit phases.
Boundary markers: The skill suggests providing subagents with instructions to "return findings only," but does not define explicit delimiters or sanitization for the code content being ingested.
Capability inventory: The agent can write specification files to the specs/ directory and create GitHub issues.
Sanitization: No explicit sanitization or filtering of input data is mentioned beyond the instruction to "vet before presenting" findings to the user.
[REMOTE_CODE_EXECUTION]: The skill instructs the agent to run pip-audit to check for dependency vulnerabilities. This is a standard security practice and uses a well-known tool. There are no patterns of executing untrusted remote scripts (e.g., pipe-to-shell).

pb-improve