The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill audits untrusted codebases, which represents an ingestion point for potentially malicious instructions embedded in external code, comments, or documentation.\n
Ingestion points: Phase 1 (Recon) and Phase 2 (Audit) in SKILL.md involve deep analysis and reading of repository files.\n
Boundary markers: Hard Rule 6 explicitly instructs the agent to treat audited content as evidence and prevents it from overriding the governing session instructions.\n
Capability inventory: The skill can execute read-only analysis commands (e.g., git log, npm audit, tsc) and spawn subagents via the 'execute' command to modify code in isolated git worktrees.\n
Sanitization: Hard Rule 4 prevents the reproduction of secrets, and the workflow requires a manual review of all plan-generated diffs by the primary advisor agent.\n- [COMMAND_EXECUTION]: The skill uses local system commands for reconnaissance and codebase analysis as part of its primary function.\n
Evidence: Phase 1 and 2 instructions specify the use of git, npm, pnpm, and various linting tools to identify build and test commands.\n
Mitigation: Hard Rule 2 strictly limits these commands to read-only operations and forbids any mutation of the user's working tree outside of the isolated plan execution workflow.\n- [METADATA_POISONING]: The skill metadata identifies the author as 'shadcn', whereas the skill is provided by 'somtougeh'. This discrepancy in author attribution could lead to confusion regarding the skill's origin.\n- [DATA_EXFILTRATION]: The skill includes functionality to publish audit findings to external GitHub issues.\n
Evidence: The --issues flag in the 'Invocation variants' section of SKILL.md allows the skill to communicate with the GitHub API via the 'gh' CLI.\n
Mitigation: The skill requires a visibility check (gh repo view) and explicit user confirmation before publishing sensitive data to public repositories to prevent data exposure.

improve