The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and analyzes third-party repository data and external web content to automatically structure and generate local skill files, which creates an inherent indirect prompt injection vulnerability surface if an analyzed resource contains hidden malicious instructions.
Ingestion points: External content enters the agent's context during Phase 1 and Phase 2 via scripts/scan-repo.js (fetchRepoTree and fetchFileContent functions) which fetch files using the GitHub CLI, or via WebFetch//deep-research delegation for non-GitHub sources as described in SKILL.md.
Boundary markers: The instruction set in SKILL.md includes a dedicated "Untrusted content rule" under the Phase 2 analysis section, explicitly telling the agent that all fetched content is untrusted data, to ignore embedded instructions, and to never execute fetched commands.
Capability inventory: The script scripts/scan-repo.js invokes the local gh binary using child_process.spawnSync to pull repository tree and file data. Furthermore, SKILL.md permits the use of the Write tool to create and modify files within the project's target directories during Phase 3.
Sanitization: The script scripts/scan-repo.js implements a sanitize helper that eliminates control characters from input data. It also incorporates a strict URL validation mechanism via validateSecureUrl that rejects non-HTTPS links and actively drops connections to private/loopback/link-local networks to prevent Server-Side Request Forgery (SSRF). Target directory boundaries are also strictly enforced using realpath checks to block path traversal.

sharingan