The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to analyze untrusted external data, such as source code and compliance documents, which serves as a significant ingestion point for potential malicious instructions.
Ingestion points: The agent is instructed to use Read and Bash tools to gather information from user projects, codebases, and documentation files during security reviews and compliance audits.
Boundary markers: The instructions do not define clear delimiters or "ignore embedded instructions" protocols for the data being audited, increasing the risk of the agent obeying instructions hidden within the analyzed files.
Capability inventory: The skill is granted extensive capabilities, including Bash (allowing for git, grep, and find operations), as well as Read, Write, and Edit tools, which could be abused if an indirect injection attack is successful.
Sanitization: No explicit sanitization, validation, or filtering mechanisms are described for processing the external content before it is integrated into the agent's context.

audit-expert