The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a helper script, scripts/sweep-ledger.py, which executes git commands using subprocess.run. The implementation is secure as it passes arguments as a list rather than a shell string, effectively preventing command injection.
[COMMAND_EXECUTION]: The agent is instructed to "Discover build, test, lint, typecheck, format, and codegen checks" within the repository and establish a baseline by running them. This is a potential risk if the repository being audited is untrusted, as the agent might inadvertently execute malicious code defined in common project files like package.json, Makefile, or requirements.txt.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because its core function requires reading and processing the entire content of an arbitrary repository.
Ingestion points: Untrusted data enters the agent context whenever it reads source files, documentation, or configuration from the repository being audited (documented in SKILL.md under the "Setup" and "Inspect and Fix" sections).
Boundary markers: The instructions do not specify the use of delimiters or provide "ignore embedded instructions" warnings for the agent when it ingests repository content.
Capability inventory: The agent possesses the capability to write to the filesystem, perform Git operations, and execute local build/test/lint tools.
Sanitization: The skill does not include any explicit mechanisms for sanitizing, escaping, or filtering the content read from the target repository before it is processed by the model.

fresh-eyes-sweep