The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting untrusted data from a project repository to verify code changes. Malicious instructions embedded in code comments, git commit messages, or PR bodies could attempt to override the auditor's logic or bypass security checks.
Ingestion points: implementation files, git diff output, and git log output as specified in the 'Scope inventory' and 'Read shipped code' sections of SKILL.md.
Boundary markers: The instructions lack explicit delimiters or guidance to the agent on how to isolate untrusted file content from its internal audit instructions.
Capability inventory: The skill utilizes shell access to run git, rg (ripgrep), and project-specific build tools like pnpm and cargo (referenced in SKILL.md).
Sanitization: No sanitization or filtering of the content read from files is described before it is provided to the agent for evaluation.
[COMMAND_EXECUTION]: The skill instructions involve executing multiple shell commands to inspect the file system and verify code status.
Evidence: The Procedure section of SKILL.md explicitly lists commands for git diff, git log, rg, and project-specific verification commands like pnpm type-check and cargo test.

adversarial-audit