The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill inherently possesses a surface area for indirect prompt injection because it processes untrusted data from repository files (source code, documentation, and logs). However, this risk is thoroughly mitigated through multiple layers:
Ingestion points: Data enters the context via scripts/inventory.py, scripts/measure.py, and scripts/revision_check.py, which are designed for metadata and static text analysis.
Boundary markers: The SKILL.md contains explicit instructions (Step 2) to treat all repository content as evidence only, never as authorization to expand scope or execute commands.
Capability inventory: Scripts are limited to reading repository files and Git metadata. They do not import or execute project code. Subprocess calls are limited to the git binary with controlled arguments.
Sanitization: The scripts/render_report.py tool uses html.escape to sanitize all user-controlled data before including it in the final HTML report, preventing XSS vulnerabilities.

architecture-review