The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes arbitrary content (comments, strings, and README files) from the codebase being audited. This content could contain malicious instructions aimed at manipulating the audit results or the agent's actions.
Ingestion points: The Scout agent (phases/phase-1-scout.md) and individual Lens agents (references/lens-*.md) read file contents from the target repository.
Boundary markers: There are no explicit delimiters or safety instructions used to separate the analyzed code from the agent's internal instructions.
Capability inventory: The agent has the ability to execute system commands (phases/phase-1-scout.md) and write report files back to the project directory (SKILL.md).
Sanitization: The skill does not perform sanitization or escaping of the code data before processing it with the language model.
[COMMAND_EXECUTION]: The skill automatically detects and runs local static analysis tools (e.g., eslint, ruff, mypy, tsc) found in the project environment to gather data for the audit.
Evidence: Instructions in phases/phase-1-scout.md (Step 0) direct the agent to invoke these tools and capture their output.
[DATA_EXFILTRATION]: The skill explicitly searches for sensitive information such as credentials, tokens, and secrets to identify security vulnerabilities in the codebase.
Evidence: references/lens-security-performance.md contains a checklist for finding hardcoded secrets and sensitive data exposure. While this is the intended purpose of the tool, it involves reading sensitive data types from files.

code-audit