The Agent Skills Directory

Indirect Prompt Injection: The skill is designed to process untrusted external data, such as vulnerability notes, PoCs, and third-party reports, which serves as a potential surface for indirect prompt injection. The instructions mitigate this by requiring the agent to maintain a skeptical posture, treat inputs as hypotheses, and verify all claims against the actual source code.
Ingestion points: Vulnerability notes, disclosure reports, PoCs, source trees, and scanner findings (referenced in SKILL.md).
Boundary markers: Not explicitly specified for input data, though structural guidelines are provided for the output.
Capability inventory: Uses git for repository analysis and discusses building or running PoCs via make or shell scripts (referenced in SKILL.md and references/report-format.md).
Sanitization: Instructions mandate skeptical validation, independent verification of source citations, and rejection of drafts that lack supporting evidence.
Command Execution: The instructions guide the agent to perform technical tasks such as inspecting Git history (git show) and running proof-of-concept code (make, ./poc) in a "disposable local lab." These capabilities are essential to the skill's primary purpose as a security research tool. Safety is managed through explicit instructions to only test within authorized boundaries and never target production systems.

vulnerability-writeup