The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted code from the user's workspace to provide feedback, which is an inherent attack surface for indirect prompt injection.
Ingestion points: In Phase 1 (Context Discovery), the skill identifies target files through user requests, git diff output, or current file context, then reads them completely.
Boundary markers: The instructions do not define specific delimiters or system-level instructions to ignore potential malicious prompts embedded in comments or strings within the analyzed code.
Capability inventory: The skill's capabilities are limited to reading files and generating a markdown report. It does not have access to network tools, nor does it attempt to execute the code it is reviewing.
Sanitization: There are no explicit sanitization or filtering steps mentioned for the content read from external files before it is processed by the model for analysis.
[REMOTE_CODE_EXECUTION]: The skill documentation describes remote script execution patterns as part of its advisory rules.
Evidence: The 'rules/distribution.md' file lists the 'curl | bash' pattern (e.g., curl -fsSL https://tool.dev/install.sh | bash) as a common but potentially risky installation method for developers to consider. The skill documents this pattern for analysis purposes and does not perform the execution itself.

dx