The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external content including pull request diffs, commits, and source code. This creates an attack surface for indirect prompt injection, where adversarial instructions embedded in comments or data within the processed files could attempt to manipulate the agent's logic or execution during the analysis phase.
Ingestion points: Git diffs, PR summaries, commit history, and library source code (SKILL.md).
Boundary markers: None explicitly defined for untrusted code segments.
Capability inventory: Shell execution (implied by "run it"), file system reading (grep, source access), and model chaining ("arena").
Sanitization: The instructions include a manual sanitization step ("strip anything private before it goes anywhere public"), but no automated sanitization for ingested code is mentioned.
[COMMAND_EXECUTION]: The instructions direct the agent to 'run real code' and 'run it' (referring to the application or scripts) to prove safety facts. This utilizes the agent's underlying shell or command execution tools to interact with the project environment.
[DYNAMIC_EXECUTION]: The workflow involves generating and executing ad-hoc test scripts or scripts that import the project's libraries at runtime to validate behavior. While this is an intended function for a developer tool, it represents the dynamic generation and execution of code within the agent's environment.

blast-radius