The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and analyze untrusted source code from repositories, which creates a risk of indirect prompt injection.
Ingestion points: External repositories scanned via the --repo flag, repository URLs and metadata provided in CSV files via --repo-file, and CMDB/CVE data ingested during stage S1 (Attack surface mapping).
Boundary markers: The skill instructions do not specify any delimiters or safety markers (such as "ignore embedded instructions") to be used when interpolating untrusted code content into LLM prompts.
Capability inventory: The harness has the capability to read local and remote files, perform network operations to LLM APIs, generate SARIF reports, and execute commands via the vvaharness CLI.
Sanitization: There is no evidence of sanitization or filtering of the processed code content before it is passed to the analysis stages.
[COMMAND_EXECUTION]: The "Programmatic Integration" section provides Python code snippets that use subprocess.run to invoke the vvaharness CLI.
Evidence: The snippets show subprocess.run(["vvaharness", "scan", "--repo", repo_path, ...]) and subprocess.run(["vvaharness", "estimate", "--repo", repo_path], ...). If the repo_path or app_id variables are populated from untrusted user input without strict validation, they could be exploited for command injection or unauthorized file system access.

visa-vulnerability-agentic-harness