The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill architecture is designed to ingest and process untrusted data from external source code repositories and live application responses to validate security findings.
Ingestion points: Untrusted content enters the agent context through the source_repo directory (local source files), the target_url responses (HTTP headers and bodies during payload testing), and findings metadata provided by external scanning tools.
Boundary markers: The skill's orchestration logic and instruction set do not explicitly define strict delimiters, XML tags, or 'ignore' instructions when interpolating external findings or source code snippets into the agent prompts, which could allow maliciously crafted code comments or data to be interpreted as system instructions.
Capability inventory: The skill is equipped with highly sensitive capabilities including performing arbitrary network requests for payload testing (SQLi, XSS, SSRF) and the verification of command injection flaws via shell interaction.
Sanitization: The instructions do not document mandatory sanitization, filtering, or escaping of content retrieved from external source repositories or target applications before it is processed by the language models.

pentest-validation