The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external websites to guide the agent through code repair tasks. This creates a surface for indirect prompt injection where a malicious website could include instructions in its DOM or API responses to manipulate the agent's behavior.
Ingestion points: The skill reads error traces (summary.md, trace.jsonl), network logs (network.jsonl), and live website snapshots via opencli browser state and opencli browser network.
Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands within the processed artifacts.
Capability inventory: The agent has permissions to Edit and Write files, as well as execute Bash commands for opencli and gh tools.
Sanitization: No sanitization, validation, or filtering of the external content is specified before the agent uses it to formulate code patches.
[DYNAMIC_EXECUTION]: The skill's core functionality involves generating code patches and subsequently executing that code, which is a form of dynamic execution.
Evidence: Step 4 instructs the agent to patch adapter source files (adapterSourcePath), and Step 5 directs the agent to "Verify the Fix" by running the command normally using opencli <site> <command>. If the patch generation logic is compromised via indirect prompt injection, the agent may execute malicious code locally.
[COMMAND_EXECUTION]: The skill frequently uses powerful CLI tools with arguments derived from trace data.
Evidence: The skill uses Bash(opencli:*) for website interaction and Bash(gh:*) to create GitHub issues on the jackwener/OpenCLI repository. Maliciously crafted data from a website could potentially lead to command injection if arguments are not properly handled by the agent.

opencli-autofix