The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted data from repository files and documentation to perform its analysis, creating a surface for indirect prompt injection.\n
Ingestion points: The skill uses Read, Glob, and Grep tools in Phase 2 and Phase 4 to extract content from the target project files.\n
Boundary markers: The Agent Prompt Template in references/personas.md does not specify the use of clear delimiters or instructions to the sub-agents to ignore potentially malicious instructions embedded within the target files.\n
Capability inventory: The agent and its sub-agents have access to tools including Bash, Task, Read, Glob, Grep, and Skill.\n
Sanitization: There is no mention of sanitization, escaping, or filtering of the content read from files before it is interpolated into the prompts for the persona sub-agents.\n- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to perform repository surveys and logs analysis.\n
Evidence: Phase 1 and Phase 2 of SKILL.md instruct the agent to execute shell commands such as ls, wc, du, git status, git log, and git diff. The skill attempts to implement guardrails by mandating the activation of a read-only-ops skill, but the core functionality still relies on shell command execution over the local environment.

roast