The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes arbitrary codebase files, creating a surface for indirect prompt injection where malicious instructions inside the analyzed code could influence subagent behavior.\n
Ingestion points: The Read, Grep, and Glob tools are used by specialized subagents (e.g., security-mapper, conventions-mapper) to ingest untrusted file content from the local directory.\n
Boundary markers: The prompts for the subagents do not include explicit instructions or delimiters (like XML tags or specific 'ignore' directives) to treat the ingested code content strictly as data, potentially allowing embedded instructions to be followed.\n
Capability inventory: While subagents are limited to 'Explore' (read-only) mode, they possess the Write tool to generate markdown reports in docs/codebase/. The main agent has Bash access for pre-triage operations.\n
Sanitization: The skill does not implement sanitization or validation of the content read from the codebase before it is included in the output documentation.

map-codebase