The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains instructions that explicitly attempt to override agent safety filters and human-in-the-loop protocols. Specifically, the agent is directed to 'Automatically scan and understand the entire codebase... without asking the user', 'Don't Ask Questions
Understand the codebase autonomously', and 'Don't Wait for Instructions
Scan and fix automatically'. These directives encourage the agent to bypass standard confirmation prompts when performing sensitive actions like reading all files or modifying project code.\n- [COMMAND_EXECUTION]: The instructions require the agent to 'Run all tests to ensure nothing broke', which involves executing arbitrary shell commands on the host environment. When combined with the instructions to act without user oversight, this increases the risk of unauthorized or harmful command execution.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process an entire codebase, which constitutes untrusted external data, while possessing high-privilege tool access.\n
Ingestion points: Recursive scanning and reading of every file in the project directory via tools like listDirectory and readFile.\n
Boundary markers: Absent; there are no instructions for the agent to treat data from the scanned files as untrusted or to ignore instructions embedded within the codebase being audited.\n
Capability inventory: The agent is granted capabilities for recursive file reading, broad file writing (via strReplace), and shell command execution (to run tests).\n
Sanitization: Absent; the skill does not include steps to sanitize or validate the ingested code before it is processed by the AI and used to generate refactored code or execute commands.

production-code-audit