The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data which could contain malicious instructions designed to influence the agent's audit results.
Ingestion points: The skill processes code and metadata from "user's named pull request, branch, commit, diff, or working changes" as defined in the "Establish the Change" section of SKILL.md.
Boundary markers: No explicit boundary markers or instructions to ignore embedded prompts within the diffs are specified.
Capability inventory: The skill possesses the ability to perform "read-only inspection", execute "existing tests and commands", and generate/execute a "temporary probe" as noted in the "Establish the Safety Claims" section.
Sanitization: There is no evidence of sanitization, escaping, or filtering of the external code content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill explicitly instructs the agent to execute commands to verify safety claims.
Evidence: The "Establish the Safety Claims" section in SKILL.md directs the agent to use an "existing test, focused command, or temporary probe" to exercise code paths. While the instructions require these actions to be reversible and outside the working tree, the execution of commands based on potentially malicious audited code is a notable risk.
[DYNAMIC_EXECUTION]: The skill permits the creation and execution of new code artifacts at runtime.
Evidence: SKILL.md specifies that a "temporary probe must import the same code and dependency version the application ships" to exercise behavior. This involving generating a script that imports and runs external code qualifies as dynamic execution.

blast-radius-audit