The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to recursively scan and read every file in a codebase line-by-line using readFile. This creates a significant ingestion surface for indirect prompt injection, as malicious instructions embedded in codebase comments or strings could influence the agent's behavior during the 'Deep-scan' phase.
Ingestion points: The skill uses listDirectory and readFile to ingest all files within the project root recursively.
Boundary markers: No boundary markers or instructions to ignore embedded prompts within the files are provided.
Capability inventory: The agent is granted strReplace capabilities for bulk refactoring and shell execution capabilities to 'Run all tests'.
Sanitization: No sanitization or validation of the file content is performed before the agent acts upon the 'issues' it detects.
[COMMAND_EXECUTION]: The skill mandates that the agent 'Run all tests to ensure nothing broke' after making automated changes. Since the agent determines the tech stack and entry points autonomously, this involves executing arbitrary test runners or scripts (e.g., npm test, pytest) defined within the scanned codebase, which may be untrusted.
[AUTONOMY_ABUSE]: The instructions repeatedly command the agent to 'Fix everything automatically' and 'Do all of this without asking the user for input.' While intended for efficiency, this explicitly overrides standard user confirmation guardrails for bulk file modifications and command execution, increasing the risk of unintended or malicious changes persisting in the codebase.

production-code-audit