The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external site scans (headers, page text, scripts) which can be used to deliver malicious instructions to the agent.
Ingestion points: Site evidence and repair briefs accessed via the Lockpick API/CLI or pasted by the user.
Boundary markers: The skill contains explicit guardrails advising the agent that evidence from scanned sites is untrusted and that it should not follow instructions found within it.
Capability inventory: The agent can modify repository files, create git branches, and execute CLI commands.
Sanitization: No programmatic sanitization is defined; however, the agent is instructed to ignore embedded instructions in the findings.
[REMOTE_CODE_EXECUTION]: The skill instructs the agent to use npx lockpicks login. There is a naming inconsistency between the package lockpicks (plural) and the subsequent CLI commands which use lockpick (singular). This creates a risk of the agent or user installing and executing an unintended or potentially malicious package via npx.
[COMMAND_EXECUTION]: The skill instructs the agent to use various lockpick CLI commands (brief, finding, fix, pulse, compare) to interact with an external security service and manage findings locally (e.g., writing to lockpick-fixes.md).

lockpick-fix