The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze frontend code, which serves as an external ingestion point for potentially untrusted data. Malicious instructions placed within code comments or metadata of the audited project could attempt to influence the agent's behavior during the audit process.
Ingestion points: Frontend source code files within the project directory are read using the Read, Grep, and Glob tools.
Boundary markers: The instructions do not define boundary markers or clear separators between the agent's instructions and the data being analyzed, increasing the risk that the agent may interpret data as commands.
Capability inventory: The skill is granted access to the Bash tool for shell execution, Write for file modifications, and Read for broad file access.
Sanitization: No sanitization or validation mechanisms are specified for the content of the audited code before it is processed by the agent.
[COMMAND_EXECUTION]: The skill explicitly allows the use of the Bash tool. In the event of a successful prompt injection from the audited code, the agent could be coerced into executing arbitrary shell commands within the user's environment, as there are no stated restrictions on the scope of the shell operations.

gsd-ui-review