The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is designed to ingest and analyze untrusted Ruby on Rails source code which could contain malicious instructions hidden in comments or metadata.
Ingestion points: The skill uses Read, Grep, and Glob tools to import external code into the agent context, as defined in the allowed-tools section of SKILL.md.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands within the ingested code are present in SKILL.md.
Capability inventory: The skill is configured with Bash tool access in the allowed-tools frontmatter, providing a mechanism for command execution if the agent is manipulated by injected instructions.
Sanitization: There is no evidence of sanitization or filtering of the external content before it is processed by the agent.

pragmatic-rails-reviewer