The Agent Skills Directory

[COMMAND_EXECUTION]: The orchestrator instructions in SKILL.md include a pattern where user-provided input is interpolated directly into a shell command. Specifically, in Section 4 (Sub-Skill Execution), the agent is instructed to run python3 scripts/dependency_mapper.py <target_path> and scripts/file_stats.py via the Bash tool. There is no mention of sanitization or validation for the <target_path> argument, which could allow a malicious user to perform command injection (e.g., providing a path like "; rm -rf / ; ") that the agent would execute in the shell.
[PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection (Category 8) because its primary purpose is to ingest, read, and process untrusted source code from a user-specified directory. The ingested code is then passed as context to sub-agents for analysis.
Ingestion points: The skill reads all source files (.ts, .py, .php, etc.) at the target path provided by the user (Section 4 of SKILL.md).
Boundary markers: The skill uses delimiters (=== FILE: {filepath} === and === END FILE ===) to wrap file content, which provides some separation but does not fully prevent an adversary from crafting content that breaks out of the delimiters to influence the agent.
Capability inventory: The orchestrator and its sub-agents have access to powerful tools including Bash (executing scripts), Write (saving reports), and Read (accessing the filesystem).
Sanitization: No explicit sanitization, escaping, or filtering of the ingested source code content is described before it is interpolated into the agent's prompt context.

rc-codeprobe