The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface through its documentation and findings processing logic.
Ingestion points: The skill is instructed to automatically read all markdown files in assets/findings/ and fetch/read any URLs provided in text files within assets/docs/.
Boundary markers: There are no explicit instructions to use delimiters or sanitization when processing this external content.
Capability inventory: The orchestration logic has access to Bash (curl, find, cat), ToolSearch, and the ability to spawn multiple sub-agents (Agent tool) with varying models.
Sanitization: The instructions lack validation or escaping for the content retrieved from external URLs or previous report files, which could lead to an attacker influencing the agent's behavior via malicious documentation.
[COMMAND_EXECUTION]: The orchestration logic in SKILL.md utilizes several shell commands to manage the audit workflow.
Evidence: The skill uses Bash find to identify target files, mktemp to create temporary workspaces, and cat to bundle source code with agent instructions. While these are standard for a development-focused agent, they represent an active execution environment.
[DATA_EXFILTRATION]: The skill performs a network operation to a remote server for maintenance purposes.
Evidence: In SKILL.md (Turn 1), the agent executes Bash curl -sf https://raw.githubusercontent.com/sanbir/ton-auditor-skills/main/ton-auditor/VERSION to compare local and remote versions. This targets a repository owned by the skill's author (sanbir) for a non-sensitive version check, which is documented here neutrally as a vendor-specific resource.

ton-auditor