The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted codebases and fixtures as its primary function (Ingestion points: RECONNAISSANCE.md Agents 1a-d). It possesses capabilities to write files to local storage and execute shell commands within a sandbox to validate findings (Capability inventory: SKILL.md Write isolation and HUNTING.md Core hunting method). Although the skill provides extensive boundary markers (instructions to use isolated loopback namespaces and scratch directories) and sanitization protocols (mandatory use of dummy principals and non-sensitive fixtures), the processing of untrusted content constitutes a potential surface for indirect prompt injection.\n- [SAFE]: The provided Node.js scripts (validate-coverage-ledger.cjs, validate-findings.cjs) are written with a strong defensive posture. They use race-safe file access patterns (e.g., O_NOFOLLOW, O_NONBLOCK), strictly limit file sizes and nesting depths, and perform manual pre-flight parsing of JSON to prevent resource exhaustion. No unauthorized network activity or credential exfiltration patterns were found.

security-audit