The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data from external codebases. This creates an attack surface for indirect prompt injection, where an attacker could place malicious instructions within code comments, README files, or documentation to influence the agent's behavior or findings.
Ingestion points: The skill uses Read, Grep, and Glob tools across all phases (Reconnaissance, Macro, Meso, and Micro analysis) to read files from the target directory.
Boundary markers: The instructions for sub-agents (Lens Analysts) in SKILL.md do not explicitly define boundary markers or delimiters for the code content being analyzed, which increases the likelihood of the LLM confusing code with instructions.
Capability inventory: The skill possesses significant capabilities, including Bash for command execution, Write/Edit for filesystem modification, and Task for sub-agent orchestration.
Sanitization: There is no evidence of sanitization or filtering of the content read from the codebase before it is passed to the analysis sub-agents.
[COMMAND_EXECUTION]: The skill uses the Bash tool to perform reconnaissance and history checks (e.g., wc -l, git log). While the instructions attempt to restrict these calls to specific non-executable utility commands, the presence of shell access combined with processing untrusted filenames or paths presents a potential command injection vector if the underlying platform does not provide strict isolation.
[EXTERNAL_DOWNLOADS]: The skill includes WebSearch and WebFetch in its allowed-tools list. While these are intended for legitimate research and context gathering during the audit process, they provide a capability for external data retrieval that should be monitored during operation.

codebase-audit