The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it instructs the agent to ingest and analyze the entire contents of a repository ("Analyze the Repository") without specifying safety boundaries. Malicious instructions embedded in repository files (e.g., README, source code comments, or configuration files) could attempt to influence the agent's behavior during the threat modeling process.
Ingestion points: The skill reads all primary languages, frameworks, entry points, and data stores within the target repository (SKILL.md).
Boundary markers: There are no instructions for the agent to use delimiters or "ignore embedded instructions" tags when processing repository content.
Capability inventory: The skill allows the agent to create and write to files such as .agent-security/threat-model.md and .agent-security/security-config.json (SKILL.md).
Sanitization: The instructions lack requirements for the agent to sanitize or escape data extracted from the repository before including it in the generated report.
[DATA_EXFILTRATION]: The workflow directs the agent to "Inventory Critical Assets" and specifically "Document: PII, Credentials and secrets." While this is intended for identifying areas of risk, there is a possibility that an agent might copy sensitive values (such as hardcoded API keys or PII found during analysis) directly into the documentation file (.agent-security/threat-model.md). Consolidating sensitive information into a single plaintext document within the repository can lead to accidental exposure if the file is committed to version control or accessed by unauthorized users.

threat-model