The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is configured to ingest and analyze external code files, including comments and tests, which can be controlled by third parties. This creates a vulnerability where instructions embedded in the analyzed code could influence the agent's output or behavior.
Ingestion points: The skill instructions in SKILL.md explicitly direct the agent to read project files, types, and existing code patterns.
Boundary markers: The instructions lack specific delimiters or warnings to ignore directives found within the external data being reviewed.
Capability inventory: The skill produces a markdown-formatted review report; no high-risk capabilities like network or shell execution are specified in the provided files.
Sanitization: There is no evidence of sanitization or filtering to distinguish between code to be reviewed and potential instructions contained within that code.
[PROMPT_INJECTION]: The SKILL.md file uses the $ARGUMENTS placeholder at the end of the instruction block without defined boundaries. This allows user-provided input to be appended directly to the instructions, potentially enabling a user to override the skill's logic or behavior through carefully crafted prompts.

frontend-fundamental-review