The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze external, untrusted content including code diffs, pull request metadata, and library source code. This creates an attack surface where malicious instructions embedded in comments or data within the analyzed code could influence the agent's behavior.
Ingestion points: SKILL.md (Step 1: code diffs and symbols; Step 3: library source code, API JSON, and DB columns).
Boundary markers: None present to differentiate between instructions and data.
Capability inventory: The skill directs the agent to generate and run scripts or tests (Step 4 and Step 5).
Sanitization: While the skill mentions stripping private data for privacy, it lacks sanitization to prevent the agent from obeying instructions embedded in the analyzed code.
[DYNAMIC_EXECUTION]: The verification methodology relies on the agent generating and executing code at runtime to prove that a code change is safe. This involves creating new scripts that import and call local libraries.
Evidence: SKILL.md methodology (Step 4: 'A script or test that calls the real code'; Step 5: 'Write a script or test that runs the real code, run it').

blast-radius