The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes a specific defensive instruction in Hard Rule 4, which directs the agent to treat repository content strictly as data and to flag any attempts within that content to override instructions (e.g., 'ignore previous instructions'). The static detector hit for this pattern is a false positive, as the text is used to define a security boundary rather than to bypass one.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves processing untrusted data (source code from a repository). It explicitly addresses this attack surface by instructing the agent to ignore any instructions embedded in the data. Furthermore, the skill's capabilities are restricted; it cannot execute code, install packages, or perform network requests, limiting the potential impact of a successful injection.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill enforces a strict read-only policy on the source codebase and explicitly forbids mutating operations, builds, or network calls. While it writes audit plans to the local file system, these writes are restricted to a specific plans/ or animation-plans/ directory, preventing unauthorized modification of the project's source or configuration files.
[REMOTE_CODE_EXECUTION]: The skill maintains a 'No mutating operations' rule (Hard Rule 2), which explicitly prohibits package installations (npm install, pip install) and remote script execution. The execute variant mentioned in the documentation refers to a separate process or subagent and is governed by the same read-only and safety-focused logic.

improve-animations