The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The cleanup workflow defined in references/cleanup-mode.md instructs the agent to detect and execute test and typecheck commands by reading project configuration files such as package.json, pyproject.toml, and Makefile.
Ingestion points: The agent reads untrusted repository metadata files to determine the execution environment and required build/test scripts.
Boundary markers: The instructions lack explicit boundary markers or warnings to sanitize potentially malicious commands found in these files.
Capability inventory: The skill possesses the capability to execute shell commands and write to or delete files in the local repository across multiple cleanup phases.
Sanitization: No sanitization or validation of the extracted commands is performed before execution in a subprocess.
[COMMAND_EXECUTION]: To perform its primary functions, the skill executes various third-party analysis tools (knip, madge, vulture, ruff, etc.) and project-specific scripts. While this is necessary for code review and cleanup, it provides a large execution surface that could be exploited if the target project contains malicious configuration or scripts.

code-review