The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data from source code files and staged diffs during the hygiene pass and verification gate.
Ingestion points: The agent reads the current state of code, staged diffs, commit messages, and PR descriptions as specified in SKILL.md and references/cleanup.md.
Boundary markers: The instructions do not define explicit boundary markers or delimiters to separate untrusted code content from the agent's internal reasoning or command parameters.
Capability inventory: The skill has the capability to execute shell commands to verify tests, builds, and bug fixes as described in the 'verification gate' section of SKILL.md.
Sanitization: There is no mention of sanitizing or escaping content derived from the code or task descriptions before it is used in command execution or prompt interpolation.
[COMMAND_EXECUTION]: The skill explicitly instructs the agent to identify and run fresh verification commands (e.g., test runners, build scripts, linters) against the current state of the codebase. While these are standard developer actions, executing commands based on instructions or names found in untrusted project files carries a risk of command injection or accidental execution of malicious scripts if the environment is not properly restricted.

ferris-audit