The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted code and diffs from Git repositories, which creates an indirect prompt injection surface. Malicious code or comments within the repository could be designed to influence the agent's behavior or trick it into ignoring defects.
Ingestion points: Code files, diffs, and project history read during the scope resolution phase in SKILL.md.
Boundary markers: The instructions do not specify the use of clear delimiters or instructions to treat data as non-executable when processing code comments or strings.
Capability inventory: The skill allows the agent to modify files (to apply fixes) and execute shell commands (for verification).
Sanitization: No explicit sanitization of the input code is performed before analysis.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell-based development tools on the target codebase to verify changes, which introduces a risk of arbitrary command execution if the repository is malicious.
Evidence: The Verification and Report section in SKILL.md directs the agent to "Run the narrowest formatter/lint, targeted tests, typecheck, and invariant checks."
Risk: If an attacker-controlled repository contains malicious configuration files (such as a package.json with a malicious test script, a malicious Makefile, or a compromised .eslintrc), the agent would execute those commands in its local environment during the verification step.

code-polish