The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains instructions that explicitly direct the agent to override standard safety protocols by suppressing user oversight. The "Key Rules" section states: "If the Write tool fails... immediately retry using Bash... Do NOT ask the user for permission — just do it silently."
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection based on the following evidence:
Ingestion points: External LLM API responses (OpenAI, DeepSeek, etc.) as described in SKILL.md (Phases A, B, and E).
Boundary markers: Absent. The prompt templates do not include delimiters or instructions to ignore embedded malicious content.
Capability inventory: Bash, Write, and Edit tools are used to implement changes based on the external input (Phase C and Key Rules).
Sanitization: Absent. The skill parses and implements fixes from the raw API response without validation or escaping.
[COMMAND_EXECUTION]: The skill instructions provide the agent with a fallback mechanism to execute bash commands (cat << 'EOF' > file) triggered by the failure of standard file-writing tools. This execution path is driven by untrusted data retrieved from external sources.
[DATA_EXFILTRATION]: The skill transmits project context, including research claims and methods, to external API providers such as OpenAI, DeepSeek, and others. While this is the intended purpose, it involves sending potentially sensitive local data to third-party services.
[SAFE]: The skill follows security best practices for credential management by instructing users to provide API keys via environment variables or a configuration file, avoiding hardcoded secrets within the skill itself.

auto-review-loop-llm