The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted codebase data during its scanning phase, creating a potential surface for indirect prompt injection if a file contains malicious instructions designed to influence the scanner's report or suggested fixes.
Ingestion points: Local codebase files accessed via Glob, Grep, and Read tools in Step 1 and Step 3 (SKILL.md).
Boundary markers: No explicit delimiters are defined to separate scanned file content from the agent's internal instructions.
Capability inventory: The skill utilizes Glob, Grep, Read, Edit, and Write capabilities (SKILL.md).
Sanitization: The skill performs redaction of discovered secrets in its output, though it does not explicitly sanitize file contents for instruction-like patterns.
[SAFE]: The skill implements a robust secret redaction policy (Step 3), ensuring that any credentials discovered during the scan are truncated (e.g., sk_live_a1b2...) before being displayed in the final report, preventing sensitive data exposure.
[SAFE]: The 'Fix on Request' feature (Step 5) includes strong security guardrails by requiring the agent to show proposed changes for user review and explicitly prohibiting modifications to files outside the designated project directory.
[SAFE]: The skill follows least-privilege principles by filtering checks based on the detected stack and excluding known high-noise or sensitive directories like node_modules, .git, and __pycache__ from its scan operations.

production-checklist