The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and audit untrusted third-party Swift source code, package manifests (Package.swift, Package.resolved), and CI configurations. This creates an inherent surface for indirect prompt injection where malicious instructions could be hidden in the data being processed to influence the agent's behavior.
Ingestion points: The skill instructions direct the agent to access and parse file contents including *.swift source files, Package.swift manifests, Package.resolved lockfiles, and CI configuration files (e.g., GitHub Workflows) as part of its reconnaissance and audit phases.
Boundary markers: While the skill provides extensive rules for validating input within the applications it audits, it lacks explicit instructions for the agent to use delimiters or "ignore embedded instructions" warnings when reading untrusted file content into its own internal context.
Capability inventory: The skill utilizes powerful capabilities including broad file system access, subprocess execution for building and testing code (swift build, swift test, SwiftLint, CodeQL), and potential network operations for dependency analysis and vulnerability scanning.
Sanitization: The instructions emphasize defensive coding and validation for the applications being developed but do not specify escaping or sanitization of the raw file content before it is interpolated into the agent's context for analysis.

sota-swift