The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted data from the target repository, creating a surface for indirect prompt injection attacks. Malicious instructions placed in source code, README files, or intent documents could attempt to hijack the agent's behavior during the documentation generation phases.
Ingestion points: The agent direct-inspects source code, manifests, and configuration files. It also reads the output of scripts/scan.py, which includes text snippets (TODO/FIXME markers) extracted directly from the codebase.
Boundary markers: The skill does not instruct the agent to use specific delimiters or boundary markers when interpolating untrusted codebase content into its context, nor does it provide explicit instructions to ignore embedded commands in those sources.
Capability inventory: The skill possesses the ability to write multiple files to the local file system (under .lcs/codebase/) and execute shell commands through the bundled Python script.
Sanitization: There is no evidence of sanitization or filtering of the content extracted from the repository before it is evaluated by the agent.
[COMMAND_EXECUTION]: The skill utilizes shell execution for its core functionality. It executes a bundled Python script (scripts/scan.py) which in turn calls subprocess.check_output to run git log. While these commands are used for legitimate metadata extraction, such as identifying high-churn files, they represent a functional command execution capability within the skill's workflow.

lcs-codebase-doc