The Agent Skills Directory

[COMMAND_EXECUTION]: The skill interpolates the $system and $ARGUMENTS variables directly into shell commands including readlink legacy/$system, ls -d <parent-dir>/*/ | xargs -n1 basename, and python3 "${ANTIGRAVITY_PLUGIN_ROOT}/scripts/build_report.py" $system. If these variables contain shell metacharacters and are not properly sanitized by the underlying platform, they could be used to execute arbitrary commands on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill analyzes untrusted source code from the legacy/$system directory using specialized subagents (legacy-analyst, security-auditor). Malicious instructions embedded within the codebase being analyzed (such as in code comments, README files, or documentation) could influence the subagents' analysis or instructions.
Ingestion points: File content from the legacy/$system directory is read and processed in Steps 1, 2, 3, and 5.
Boundary markers: There are no explicit delimiters or specific "ignore embedded instructions" warnings used when file content is passed to the subagents.
Capability inventory: The skill can write to the filesystem using write_to_file and execute local shell commands via scc, cloc, and python3 scripts.
Sanitization: The skill includes logic to mask hardcoded credentials in the output and verifies .gitignore or other VCS ignore files before writing sensitive data to local files.

modernize-assess