The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted source code from a target directory and passes it to several LLM-based "lens" agents for analysis. This creates a surface where malicious instructions hidden in the code (e.g., within comments or strings) could attempt to override the agent's specific auditing rules or manipulate its output.
Ingestion points: The skill reads source files from the user-defined targetPath in workflow/grill.workflow.mjs.
Boundary markers: The workflow orchestration uses system-level prompts and clear section headers to separate instructions from target data, but does not implement robust escaping for the content of the source files themselves.
Capability inventory: The sub-agents are explicitly instructed to be read-only on the source code, and the tool's only write capability is to generate a single report file in the target repository.
Sanitization: There is no evidence of sanitization or filtering of the analyzed source code to detect or neutralize potential prompt injection attacks.
[COMMAND_EXECUTION]: The skill executes several local Node.js scripts using the node command to perform environment checks and data processing. It also uses standard shell commands like ls for path verification and date for report file naming. Additionally, the probe-suites.mjs script scans the user's home directory (e.g., ~/.claude/skills) to detect other installed skills for enrichment purposes.
[DYNAMIC_EXECUTION]: The skill uses node --input-type=module -e '...' to execute inline wrappers that import its own internal scripts. This mechanism is used to perform platform detection and token discovery by dynamically loading the skill's modules within the user's shell environment.

design-grill