The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data from report/score.json, specifically the evidence strings which are described as verbatim probe output. These strings are directly incorporated into the agent's context to generate fix steps and issue reports. Without explicit sanitization or strict boundary markers, this allows potentially malicious instructions within the audit report to influence the agent's subsequent actions.
Ingestion points: report/score.json (specifically failing sub-checks, evidence strings, and fix_skill fields).
Boundary markers: Absent for the evidence strings; the instructions explicitly mandate quoting them verbatim rather than paraphrasing.
Capability inventory: Read, Write, Edit, Bash, Grep, Glob, WebSearch, and WebFetch tools are available to the agent, providing a significant capability surface if an injection were to occur.
Sanitization: No sanitization, validation, or filtering of the evidence strings or fix_skill hints is specified.

readiness-fix-plan