The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data from external repositories, creating a significant attack surface for indirect prompt injection.
Ingestion points: In Phase 2, subagents are dispatched to read every file in a cloned repository (SKILL.md, references/phase2-agent-template.md).
Boundary markers: Absent. The instructions explicitly command the agent to read all files to avoid bias but provide no delimiters or warnings to ignore malicious instructions embedded within those files.
Capability inventory: The skill possesses 'Write' and 'Bash' capabilities, and Phase 7 (IMPLEMENT) allows the agent to create new files, modify existing code, and execute local scripts based on the analysis findings (references/phase7-implement-template.md).
Sanitization: No sanitization, validation, or filtering of the content retrieved from the external repository is performed before the agent processes and acts upon it.
[EXTERNAL_DOWNLOADS]: The skill uses git clone to download full repositories from external URLs provided by the user in Phase 1 (SKILL.md). While this is the intended functionality, it involves fetching unverified content from arbitrary remote sources.
[COMMAND_EXECUTION]: The skill executes shell commands (git clone) using a user-supplied URL. Although the instructions mention parsing and extracting the repository name, if the input validation is insufficient, it could lead to command injection if the raw URL is passed directly to the shell (SKILL.md).

repo-value-analysis