The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it is designed to ingest and analyze untrusted data from external code repositories.
Ingestion points: The instructions in SKILL.md direct the agent to analyze repository files using tools like rg (ripgrep), codegraph_explore, and various LSP functions.
Boundary markers: The skill lacks explicit instructions for the agent to use boundary markers or delimiters when processing repository content to separate data from instructions.
Capability inventory: The workflow involves executing shell-level tools such as rg and codegraph explore (SKILL.md). While the skill instructions attempt to restrict the agent to read-only actions, the presence of these tools in the execution environment creates a surface for potential exploitation via malicious code content.
Sanitization: There is no mention of sanitization, filtering, or validation of the data retrieved from the repository before it is evaluated by the agent.

dry-audit