The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from diffs, intent summaries, and technical plans, creating an attack surface for indirect prompt injection. \n
Ingestion points: The skill reads diff, intent_summary, and changed_files in SKILL.md, and approach and survey data in rules/plan-mode.md. \n
Boundary markers: There are no explicit instructions or delimiters defined to separate untrusted data from the agent's instructions. \n
Capability inventory: The skill has access to file-writing tools (Edit, Write) and can execute shell commands (pnpm, tsc, pytest, git) via the procedures in rules/apply-mode.md. \n
Sanitization: No sanitization or validation logic is present to filter malicious instructions embedded within the processed code or descriptions. \n
Remediation: Implement strict boundary markers (e.g., XML tags or clear delimiters) and explicit instructions to the agent to treat diff and intent content as data only, never as instructions.\n- [COMMAND_EXECUTION]: The skill executes shell commands to verify code changes. \n
Evidence: rules/apply-mode.md specifies the execution of pnpm test, tsc --noEmit, pytest, and git checkout to validate and potentially revert changes.\n- [DYNAMIC_EXECUTION]: The skill dynamically constructs shell command strings using file paths provided in the input data. \n
Evidence: In rules/apply-mode.md, the skill generates commands like pnpm test <changed>.test.ts and pytest <changed>_test.py where <changed> is an unvalidated file path derived from the input diff. \n
Remediation: Ensure file paths are strictly validated against the current repository's file system and use safe execution APIs that prevent shell injection (e.g., passing arguments as an array rather than a single string).

optimize-approach