The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection because it processes code from untrusted sources and uses that analysis to generate code fixes or execute system commands.
Ingestion points: Project configuration and source files are searched and read throughout 'Step 2' and 'Step 3'.
Boundary markers: Absent. There are no instructions to the model to delineate or ignore potential instructions embedded in the analyzed code.
Capability inventory: The skill enables the agent to apply automated code fixes (Step 5) and execute build commands (Completion Build Gate).
Sanitization: Absent. The skill does not define methods for sanitizing data read from files before processing.
[COMMAND_EXECUTION]: The 'Completion Build Gate' directs the agent to execute build or test commands based on the project's local configuration. This allows for the execution of arbitrary scripts and binaries present in the user codebase being audited.
[EXTERNAL_DOWNLOADS]: The skill references and directs the agent to the official vendor documentation at https://docs.purchasely.com/. An automated security scan flagged this domain as potentially malicious, though it corresponds to the legitimate documentation site for the skill author.

purchasely-review