The Agent Skills Directory

[Indirect Prompt Injection Surface]: The skill's primary function is to analyze untrusted code changes. This creates an inherent surface for indirect prompt injection, where malicious instructions could be embedded in the code under review. The skill mitigates this by instructing the agent to focus on the code path rather than the narrative (e.g., commit messages), which is a common practice for security analysis tools.\n- [Command Execution for Scanning Logic]: The instructions specify shell commands to invoke local Python scripts (generate_rank_input.py) for processing repository data. These commands use placeholders for repository paths and revisions. This is a functional requirement for the skill to perform complex discovery tasks that require specialized tooling beyond pure LLM capabilities.\n- [Dynamic Construction of Commands]: The workflow involves constructing command-line arguments dynamically based on the current repository state (e.g., base and head revisions). While this is a common pattern for integration with CLI tools, it relies on the execution environment to provide sanitized path and revision variables.

finding-discovery