The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted source code from a repository, creating a potential surface for indirect prompt injection attacks.
Ingestion points: The skill reads wide scopes of the repository files during Phase 1 (Recon) and Phase 2 (Audit) as defined in SKILL.md.
Boundary markers: SKILL.md contains a specific safety rule ("Hard Rule 4") that instructs the agent to treat repository content as inert data and explicitly ignore instructions like "ignore previous instructions" found within the code.
Capability inventory: The skill has the capability to read files, write markdown plans to a specific directory (plans/), and execute local git commands.
Sanitization: While no explicit sanitization logic is described, the skill's instructions require it to flag steering attempts as findings rather than obeying them.
[COMMAND_EXECUTION]: The skill instructions include the execution of local shell commands to facilitate the auditing workflow.
Evidence: SKILL.md and PLAN-TEMPLATE.md specify the use of git rev-parse --short HEAD to identify the codebase state when generating plans.
Evidence: The execute variant in SKILL.md mentions using subagents in isolated worktrees, which implies further git operations for branch and file management.

improve-animations