The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze external codebases, which creates an attack surface for indirect prompt injection if the processed code contains malicious instructions intended to subvert the agent's behavior.
Ingestion points: External source code and configuration files accessed via the Read, Grep, and Glob tools.
Boundary markers: The skill provides a structured "Review Process" and "Output Format" to guide the agent, though it does not define explicit delimiters (like XML tags or unique markers) to encapsulate the untrusted code content being reviewed.
Capability inventory: The skill has access to Bash and Task tools as defined in the allowed-tools frontmatter, which could be exploited if an injection successfully compromises the agent's logic.
Sanitization: There are no specific instructions for the agent to sanitize or escape the content of the files it reads before processing them.
[DYNAMIC_EXECUTION]: The skill contains references to dangerous functions such as eval(), exec(), and pickle.loads(). These are present strictly as reference documentation and examples of patterns for the agent to identify and flag during its security review process; they are not intended for execution by the agent itself.

security-review