The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local instrumentation script located at ./scripts/log-skill.sh with the current shell PID as an argument. It also encourages the use of shell commands for auditing, such as grep to search for patterns in source code and npm to execute project scripts (lint, test, build), which may run code defined in an untrusted project's configuration.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data such as source code, pull request descriptions, and implementation plans. This creates an attack surface where instructions embedded in the analyzed files could attempt to influence the agent's behavior.
Ingestion points: Reads source code files (.ts, .tsx), pull request metadata, and plan documentation.
Boundary markers: The instructions lack explicit delimiters or warnings to treat processed code as data rather than instructions.
Capability inventory: The skill has the ability to execute shell commands (grep, npm, local scripts), read files, and potentially write to the filesystem during builds.
Sanitization: No specific sanitization, filtering, or validation of the ingested code content is implemented in the provided workflows.

code-review