The Agent Skills Directory

[PROMPT_INJECTION]: The skill operates on the repository's 'instruction surface' (files like CLAUDE.md and rules in .claude/rules/), which constitutes an untrusted data ingestion point for Indirect Prompt Injection. However, the risk is mitigated by delegating the actual analysis to specialized plugins and enforcing strict boundaries where the audit tool itself does not execute the instructions found. There are no explicit boundary markers like 'ignore embedded instructions' mentioned in the processing logic, but the delegated model (Category 8) is appropriate for its primary purpose.
[COMMAND_EXECUTION]: The skill makes extensive use of git commands (e.g., git rev-parse, git ls-files, git worktree list, git status --porcelain, git hash-object) to inventory the project and verify that the repository tree remains stable during the audit. These are standard, well-documented uses of shell tools for a repository-scoped auditing utility.
[DATA_EXFILTRATION]: To perform its audit, the skill reads repository content and configuration files. It writes the resulting reports either to a dedicated plugin data directory (CLAUDE_PLUGIN_DATA) or to a user-specified path within the repository. No unauthorized network operations or transmissions to external, non-whitelisted domains were identified.
[SAFE]: The skill incorporates several security best practices, including a strictly defined read-only contract for managed organizational policies and user-scope configuration files. It also implements a deterministic state machine to ensure audit consistency and prevent the creation of conflicting or corrupted report artifacts.

audit-pass