The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the target codebase and external reports, creating a surface for indirect prompt injection.
Ingestion points: The skill reads files from the target directory, git history via git log, and external files supplied via the --vulns, --design-doc, and --seed arguments as defined in the SKILL.md, bootstrap.md, and interview.md files.
Boundary markers: There are no explicit instructions or delimiters defined to isolate ingested data from the agent's control logic during analysis, which could allow instructions hidden in the target code to influence agent behavior.
Capability inventory: The skill utilizes shell commands limited to specific binaries (git, gh, find, ls, cat) and a local helper script, along with file write capabilities and the ability to spawn sub-agents.
Sanitization: The skill mitigates risks by using a specialized script (.claude/skills/_lib/checkpoint.py) that performs JSON validation and confines file operations to the current working directory.
[EXTERNAL_DOWNLOADS]: The skill retrieves security advisories from GitHub's official API to inform the threat model.
Evidence: The Advisory fetcher agent in bootstrap.md executes gh api /repos/{owner}/{repo}/security-advisories to gather public vulnerability data.
Note: This reference targets GitHub's official API, a well-known service, and does not involve the execution of remote code.

threat-model