The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill utilizes dynamic command execution placeholders (!) in the Context section of SKILL.md to retrieve current repository information at load time.
Commands used include git branch, git status, git log, and test -f.
These are standard development commands used to provide the agent with relevant project state and do not involve exfiltration, sensitive file access, or user-input injection.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze and modify files within a repository, creating a surface for potential indirect prompt injection from untrusted code.
Ingestion points: The agent processes repository files defined by the scope argument (e.g., paths or features) as described in the instructions.
Boundary markers: No specific delimiters or safety instructions are defined to separate ingested code from the agent's instructions.
Capability inventory: The agent has the ability to write to the fix.md ledger, execute verification sub-agents (which may run tests or UI rendering tools), and modify the codebase to resolve findings.
Sanitization: No explicit sanitization or filtering of the repository content is performed before it is processed by the verification angles.
Mitigation: The risk is partially addressed by the requirement for "two independent verifiers" for non-trivial claims and the use of a formal ledger for triaging findings.

audit-repo