The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and analyze external data from the local filesystem, which creates a surface for indirect prompt injection.
Ingestion points: The skill instructions in SKILL.md (Step 1) direct the agent to read barrel exports (index.ts, index.js), component directories, documentation files, and Storybook hierarchies.
Boundary markers: The instructions do not specify the use of delimiters or explicit 'ignore instructions' prompts when the agent processes the content of these external files.
Capability inventory: The skill has access to Write and various Bash tools, which could potentially be misused if the agent inadvertently follows instructions embedded within the files it is auditing.
Sanitization: There is no mention of sanitizing or filtering the content read from the project files before it is processed by the agent.
[COMMAND_EXECUTION]: The skill configuration allows for the execution of several filesystem and text processing commands.
Evidence: The allowed-tools field in SKILL.md includes Read, Write, Grep, Glob, Bash(cat:*), Bash(find:*), Bash(head:*), and Bash(ls:*).
These tools are aligned with the skill's stated purpose of searching for and reading naming conventions in a codebase, but they provide high visibility into the local environment.

naming-audit