The Agent Skills Directory

[Indirect Prompt Injection Surface]: The skill is designed to ingest and act upon 'security findings' and 'remediation requests' provided as external data. This creates a surface where malicious instructions could potentially be embedded in the input data to influence the agent's behavior. The skill effectively mitigates this risk by requiring the use of independent 'investigator' and 'reviewer' agents with limited context to validate the findings and proposed fixes.
[Command Execution]: To perform its core function, the skill instructs the agent to execute repository-native commands for building, testing, and verifying security fixes. The instructions emphasize using the 'narrowest' scope and 'repository-native' tools to ensure the integrity of the development environment.
[File System Access]: The skill references pathing to external artifacts, such as ../../references/scan-artifacts.md. This is used to resolve security scan data required for the remediation process and is consistent with the skill's intended use in a controlled development environment.

fix-finding