The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill audits and processes source code from external repositories, which serves as a potential vector for indirect prompt injection. Malicious instructions embedded within the audited code (e.g., in comments or strings) could attempt to influence the agent's behavior.
Ingestion points: The agent reads all files within the src/ directory and the configuration file located at .claude/tend/config.yaml.
Boundary markers: The instructions do not explicitly mandate the use of delimiters or 'ignore' instructions when reading the untrusted source code.
Capability inventory: The skill has the capability to read and write files (providing a diff), and execute shell commands including grep, typecheck, lint, and tests.
Sanitization: No specific sanitization or escaping of the ingested code is described before the agent processes it.
[DYNAMIC_EXECUTION]: The skill executes development scripts defined within the repository being audited.
Execution method: The skill runs typecheck, lint, and project-specific tests during the Fix and Verify phases. These are typically defined in package.json or other project configuration files.
Risk: If the repository being audited is malicious, these scripts could be configured to execute arbitrary code on the host system when triggered by the agent's verification process.

tend-perf