The Agent Skills Directory

[PROMPT_INJECTION]: The orchestrator instructions in SKILL.md (Parallel Mode section) explicitly state that when dispatching subagents, the "runtime does not enforce the file's frontmatter tools restriction." This constitutes an attempt to bypass security boundaries or platform-enforced constraints on subagent capabilities.
[COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to perform git operations, calculate metrics, and execute test suites. While necessary for the skill's primary function, this represents a significant capability that could be abused if the agent's logic is subverted.
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection because it ingests codebase content and executes shell commands based on that content (e.g., running tests). Malicious instructions hidden in code comments or test files could influence the agent's behavior.
Ingestion points: Codebase files read during Discovery (Step 2), Assessment (Step 3), and Execution (Step 5) in SKILL.md.
Boundary markers: None identified; the skill processes code content without specific delimiters or warnings to ignore embedded instructions.
Capability inventory: Bash for test execution and system operations, Write and Edit for file modification, and Agent for subagent delegation.
Sanitization: No sanitization or validation of the ingested codebase content is performed before analysis or execution.

refactor