The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external content, such as source code directories, architecture diagrams, and data inventories. This creates a risk that an attacker could embed malicious instructions within these files that the AI agent might execute.
Ingestion points: The skill reads external directories (/owasp-scan), architecture design files (/threat-model), and data inventory JSON files (/gdpr-audit).
Boundary markers: The skill instructions do not provide explicit delimiters or warnings to the agent to treat the content of these external files as untrusted data rather than instructions.
Capability inventory: The skill has access to powerful CLI tools such as aws, npm, git, and curl, which could be leveraged if the agent is manipulated via an injection.
Sanitization: No sanitization or validation steps are defined for the data extracted from scanned files.
[EXTERNAL_DOWNLOADS]: The skill instructions direct users to download the skill and referenced security utilities (detect-secrets, gitleaks) from third-party GitHub repositories that are not associated with the verified vendor. While these tools are well-known, cloning from unverified accounts like sparkfinderoven or hesreallyhim introduces supply chain risks.
[COMMAND_EXECUTION]: The skill provides templates and instructions for the agent to generate and execute administrative shell scripts. These include high-privilege actions like modifying IAM policies (aws iam attach-user-policy) and deleting access keys. While intended for remediation, these commands could be dangerous if the agent's logic is influenced by malicious inputs during a security scan.

sparkfinderoven-security-compliance-skills