The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process content from external Git repositories, which constitutes a vulnerability surface for indirect prompt injection.
Ingestion points: Repository files and content are read into the agent's context through commands like rg (ripgrep), git grep, and standard file reads described in the workflow of SKILL.md.
Boundary markers: There are no explicit instructions for the agent to use delimiters or ignore potentially adversarial instructions found within the cloned source code.
Capability inventory: The skill possesses capabilities that could be targeted by injection, including shell command execution (git, rg, find, du) and task delegation to subagents.
Sanitization: No sanitization or intent-validation of the repository content is specified before the agent processes and reasons about it.
[COMMAND_EXECUTION]: The skill relies on shell commands to manage the repository cache and perform analysis.
Evidence: SKILL.md details the execution of git for status checks, remotes, fetching, and cloning, as well as du and find for cache cleanup.
[EXTERNAL_DOWNLOADS]: The skill facilitates the download of source code from external Git providers.
Evidence: Implementation of git clone to fetch external repositories into the ~/.repos directory, as specified in the Workflow section of SKILL.md.

explore-repo