The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands to inspect repository state and run analysis tools.
Evidence: In SKILL.md, the agent is instructed to run git status --short and "repository-discovered, non-deploying tests, builds, linters, type checks, help commands, and already-configured scanners."
Mitigation: The skill explicitly prohibits destructive commands, deployments, credentialed services, and rewriting formatters to maintain a read-only boundary.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted third-party code, which presents a surface for indirect prompt injection.
Ingestion points: Reads source code, manifests, lockfiles, and CI configurations from external repositories as described in SKILL.md and references/supply-chain.md.
Boundary markers: Instructs the agent to "follow the user request and every applicable AGENTS.md before doing anything else" and maintains an "audit boundary."
Capability inventory: Includes file reading, shell command execution, and network access for dependency research.
Sanitization: Includes specific instructions to redact credentials and sensitive values found in the audited code.
[DATA_EXPOSURE]: The skill contains proactive measures to prevent accidental data exfiltration.
Evidence: SKILL.md mandates that the agent "Never expose credentials or sensitive values" and "Redact values while preserving the file, line, category, and evidence needed to act."
Evidence: references/security-review.md provides further guidance on identifying and protecting secrets discovered during audits.

deep-code-audit