The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill performs a comprehensive sweep of the repository (Subagents 1-8), ingesting all production and test source code into the agent's context for analysis. This creates an attack surface where instructions embedded in the code being audited could influence the subagents' behavior.
Ingestion points: The skill reads all files within packages/client/src/, packages/cli/src/, and tests/ across the entire repository.
Boundary markers: The instructions for the subagents do not define clear boundaries or 'ignore' directives for the content being read, meaning malicious comments or strings in the source code could be misinterpreted as instructions by the subagents.
Capability inventory: The subagents possess file-reading and multi-agent reporting capabilities, which are used to aggregate findings into a single report.
Sanitization: There is no evidence of sanitization or filtering of the ingested file content to prevent embedded instructions from affecting the subagents.

audit-architecture