The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes structured data from the CogniCode CLI/MCP tool to generate reports and diagrams. This creates a potential surface for indirect prompt injection if the tool output is manipulated by an attacker in the target codebase.
Ingestion points: Data is read from JSON ledgers in ~/.cognicode-diagrams/workspaces/<id>/evidence/ (specifically claims.json, queries.json, and terms.json).
Boundary markers: The prompt instructions in SKILL.md do not explicitly define boundary markers for tool output, although the skill emphasizes the distinction between 'observed code' and 'inference'.
Capability inventory: The skill possesses the capability to execute system commands via subprocess.run to manage rendering containers.
Sanitization: Multiple Python scripts (e.g., scripts/report_thinking.py, scripts/editorial.py, scripts/moldable_views.py) implement robust HTML and Markdown escaping to prevent cross-site scripting (XSS) and injection into the generated reports.
[COMMAND_EXECUTION]: The skill uses Python scripts to manage local services and rendering tools.
Subprocess Execution: Scripts scripts/projectors.py and scripts/render_markmap.py use subprocess.run() to start and stop OCI containers (Podman/Docker) for rendering C4 models and Markmap diagrams.
Safety Measures: Command execution is restricted to a pre-validated list of engines (podman or docker). Container images are either well-known official images or built locally from a provided Containerfile. Networking is disabled by default (--network none) for rendering tasks to prevent data exfiltration.

cognicode-diagrams