The Agent Skills Directory

[PROMPT_INJECTION]: The skill is designed to analyze entire codebases, which involves ingesting significant amounts of untrusted data from the repository being reviewed. This creates an attack surface for indirect prompt injection where malicious instructions could be embedded in the audited code (e.g., in comments or documentation) to influence the agent's findings or remediation plans.
Ingestion points: The workflow involves reading various repository files, including root manifests, environment templates, and source code files across the application.
Boundary markers: The instructions lack specific guidance on using delimiters or 'ignore' markers to prevent the agent from potentially following instructions found within the repository content.
Capability inventory: The skill utilizes file system access to read code and shell commands (grep) to search for patterns.
Sanitization: There is no explicit requirement to sanitize or validate the content of the files being read before they are processed by the LLM.
[COMMAND_EXECUTION]: The instructions direct the agent to use shell commands like grep to perform its analysis. While these are specific tools used for auditing, they represent the skill's reliance on shell interaction with the host system.
Evidence: The skill suggests using commands such as grep -rL 'auth()' src/app/api to identify missing security guards.

weekly-risk-review