The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. Its core functionality involves cloning external, untrusted repositories from GitHub and instructing an agent to 'thoroughly review codebases' using commands like cat, grep, and rg. Malicious content (instructions hidden in code comments or README files) within those repositories could attempt to override the agent's primary mission or manipulate its output.
Ingestion points: External repositories cloned into Experiment/code_references/ are read using cat, sed, grep, and rg as described in SKILL.md and the system prompts for the Code Survey Agent.
Boundary markers: Absent. The prompts do not contain instructions to treat external codebase content as untrusted data or delimiters to isolate it from the agent's instructions.
Capability inventory: The skill possesses the ability to clone repositories, navigate file systems, read files, and search text across multiple directories using standard Linux utilities.
Sanitization: Absent. Content from untrusted external sources is read directly into the agent's context without filtering or escaping.
[EXTERNAL_DOWNLOADS]: The skill performs legitimate external downloads as part of its intended research workflow.
Evidence: The script scripts/github_search_clone.py uses the requests library to query the GitHub API and uses git clone to download repositories to the local environment.
[COMMAND_EXECUTION]: The skill executes several shell commands to manage codebases and perform analysis.
Evidence: The skill instructions and associated agent prompts utilize git, ls, find, tree, cat, rg, grep, and sed. The helper script scripts/github_search_clone.py uses subprocess.run() to execute git clone commands, though it correctly uses a list format rather than a raw shell string.

inno-code-survey