The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data (the entire user codebase) and has extensive capabilities to modify, delete, and execute code. This creates a vulnerability where malicious instructions embedded in source files (e.g., in comments or string literals) could be followed by the agent during its audit process.
Ingestion points: Every file in the repository, including source code, configuration files, and documentation (SKILL.md).
Boundary markers: Absent. The skill does not provide delimiters or instructions to ignore embedded directives within the files it reviews.
Capability inventory: The skill has broad file system access, including file deletion (e.g., build artifacts, logs, and sensitive files like .env) and file modification (fixing dead code, quality issues, and security vulnerabilities). It also suggests executing commands to verify the application's state.
Sanitization: Absent. There is no evidence of filtering or validation of the content read from the codebase before the agent acts upon it.
[COMMAND_EXECUTION]: The skill instructs the agent to run the application ("run the app") and external security tools ("npm audit") as part of its verification process. Executing code from an untrusted repository, especially when the skill is also authorized to modify that code, presents a risk of executing malicious logic introduced by an attacker or through indirect prompt injection.

codebase-audit-pre-push