The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted technical data during the threat modeling workflow.
Ingestion points: The skill reads external artifacts such as architecture documentation, component lists, and dependency manifests like package.json and requirements.txt as described in the inputs section.
Boundary markers: There are no explicit delimiters or specific instructions for the agent to disregard potential instructions embedded within these external documents.
Capability inventory: The skill is configured with Read, Write, and Edit tools, giving it the ability to modify project documentation based on its analysis.
Sanitization: No input validation or sanitization is implemented to filter natural language commands from the analyzed data.
[COMMAND_EXECUTION]: The skill generates shell command templates for data persistence.
Evidence: The workflow provides specific bash command strings in section 8.5 intended to be used with a platform SDK script located at ~/.claude/scripts/appsec-sdk.sh.
Restriction: Direct exploitation is mitigated by the skill's environment configuration, which explicitly lists Bash as a forbidden tool, preventing the skill from executing these commands autonomously.

security-governance-threat-modeling