The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill has a broad attack surface for indirect prompt injection because it is designed to ingest and process the entire contents of an audited repository, including third-party code and documentation.\n
Ingestion points: The skill reads and greps through all files in the target repository using the Read, Grep, and Bash tools.\n
Boundary markers: While the instructions emphasize read-only behavior and objective evidence, the skill does not use advanced techniques (like specialized delimiters or pre-processing filters) to isolate the agent's instructions from potentially malicious prompts embedded in the repository's files.\n
Capability inventory: The agent possesses Bash, Agent, and Write capabilities, which could be exploited if a malicious file successfully overrides the agent's system instructions.\n
Sanitization: The skill mandates secret redaction via regex and model instructions, but it lacks specific sanitization for natural language instructions found in the repository.\n- [COMMAND_EXECUTION]: The skill frequently uses the Bash tool to execute search and discovery commands across the repository.\n
Evidence: Reference files such as access-management.md and infrastructure-network.md contain scripted grep, find, and ls commands.\n
Context: These commands are used to identify security patterns, configuration settings, and policy documents. They are implemented in a read-only fashion consistent with the skill's purpose as an audit tool.

soc2-audit