The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits metadata poisoning by impersonating a trusted entity. The YAML frontmatter in SKILL.md identifies the source_repo as cloudflare/security-audit-skill, implying ownership by Cloudflare, a trusted organization. However, the skill is authored by an independent community member ('sickn33'), creating a deceptive context that could lead users to over-trust the tool with sensitive codebases.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its core functionality of ingesting and processing untrusted data.
Ingestion points: The research agents described in RECONNAISSANCE.md (Agents 1a, 1b, 1c) read and analyze entire codebases from a user-specified <path>.
Boundary markers: While AI-AND-LLM.md acknowledges the risk of prompt injection, the skill lacks explicit implementation of robust delimiters or 'ignore' instructions for the sub-agents it spawns.
Capability inventory: The agent utilizes a 'Task tool' to spawn sub-agents and has the capability to write multiple files (REPORT.md, findings.json, target.json) to the local file system. It also instructions the agent to execute code harnesses for verification.
Sanitization: The skill relies on a 'Mandatory confirmation gate' requiring human approval before executing active probes or exploits. However, the initial reconnaissance and analysis phases process untrusted data without sanitization.
[REMOTE_CODE_EXECUTION]: The methodology outlined in HUNTING.md and SKILL.md involves 'dynamic execution'. It instructs the agent to extract suspect code from the target repository into 'minimal standalone harnesses' and execute them to reproduce vulnerabilities. Running code extracted from an untrusted codebase poses a risk of remote code execution if the target contains malicious logic designed to exploit the auditor.
[COMMAND_EXECUTION]: The skill performs scoped reconnaissance and adversarial review which involves executing shell commands to probe systems. While gated by a confirmation mechanism, the agent is granted the capability to generate and suggest these commands based on its analysis of untrusted files.

cloudflare-security-audit