The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is inherently designed to ingest and analyze untrusted third-party source code.
Ingestion points: The agent is instructed to identify language/stack and trace data flows within code provided by the user or found in the environment (SKILL.md, references/code_security_scope_and_workflow.md).
Boundary markers: The skill provides a structured workflow and checklist but does not explicitly define delimiters for separating user-provided code from the agent's instructions.
Capability inventory: The skill guides the agent's review process, which typically involves file reading and potentially writing fixes, but the skill itself does not invoke dangerous tools.
Sanitization: The skill relies on the agent's internal safety guardrails and the structured review process to mitigate risks from processing malicious code snippets.
[COMMAND_EXECUTION]: Documentation within the skill (references/injection_and_input_validation.md) describes vulnerable patterns such as os.system(user_input) and subprocess with shell=True. These are provided as negative examples to help the agent detect command injection vulnerabilities in target code.
[DYNAMIC_EXECUTION]: The skill references dangerous dynamic execution patterns like eval(user_input) and new Function(user) within its references/injection_and_input_validation.md file. These mentions are strictly educational, serving to define the 'Code Injection' vulnerability class (CWE-94) for the agent.
[SAFE]: The skill uses clear, professional language to define security scope and workflows. All examples of insecure code are clearly labeled as 'Vulnerable patterns' and contrasted with 'Secure patterns'. There is no evidence of obfuscation, hidden URLs, or unauthorized network activity.

code-security