The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill establishes a vulnerability surface for indirect prompt injection by design, as it requires the agent to read and evaluate untrusted source code and git diffs.
Ingestion points: The scripts/scan.py script reads local repository files using read_lines() and captures source code changes via git diff output.
Capability inventory: The skill scripts utilize subprocess.run to execute git commands and have the capability to read any local file within the user's project scope.
Boundary markers: There are no explicit boundary markers or instructions to help the agent distinguish between code content and potential embedded instructions within the scanned files.
Sanitization: The script matches patterns but does not sanitize or escape the retrieved code snippets before presenting them to the agent for triage.
[COMMAND_EXECUTION]: The skill relies on the local git installation to identify code changes and project structure.
Evidence: The git() function in scripts/scan.py executes commands such as git diff, git ls-files, and git merge-base using subprocess.run(). It uses a list of arguments rather than a single string, which is the recommended safe practice to prevent shell command injection.

footgun-scan