The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from both codebase files and live web application interfaces, creating a vulnerability to indirect prompt injection.
Ingestion points: Data is ingested during the codebase exploration in Phase 2 and live browser interaction in Phase 5.
Boundary markers: There are no specific delimiters or instructions provided to the sub-agents to distinguish between the audited content and the agent's instructions.
Capability inventory: The skill utilizes task management tools and browser automation (via tabs_context_mcp) which could be misused if the agent is compromised by injected instructions.
Sanitization: The instructions do not specify any validation or sanitization for the data retrieved from external sources.
[EXTERNAL_DOWNLOADS]: The documentation file examples/abuse-case-example.md includes the domain tempmail.com, which has been flagged by security scanners. Within the skill's context, this is a reference to a disposable email service used to illustrate an abuse scenario for the auditor to detect, rather than an attempt by the skill to communicate with the domain.
[COMMAND_EXECUTION]: The skill employs browser automation tools to interact with web applications during the verification phase. These tools are used to simulate user behavior and verify findings, which is a core part of the skill's functionality but represents a significant capability level.

adversarial-audit