The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) because it ingests untrusted data from system logs to generate executable logic.
Ingestion points: Reads execution data from .claude/logs/evidence-ledger.jsonl in Step 1.
Boundary markers: The skill does not define specific delimiters or warnings to prevent the agent from obeying instructions embedded within the log entries.
Capability inventory: The skill has the capability to write to security hooks (tobari-gate.js), execute shell commands (node, git, gh), and create Pull Requests.
Sanitization: No validation or sanitization of the log content is described before it is interpolated into code generation templates.
[DYNAMIC_EXECUTION]: The skill generates JavaScript regex and logic (referred to as "antibodies") at runtime based on log analysis and applies these patches to the project's security infrastructure. It also executes the generated code via node --test to verify functionality.
[DATA_EXFILTRATION]: The skill accesses the evidence-ledger.jsonl file, which contains sensitive historical data regarding tool usage and file paths. It performs network operations to GitHub for Pull Request creation, which involves transmitting these findings and generated code.
[COMMAND_EXECUTION]: The skill utilizes the agent's command execution capabilities to run node for testing and git/gh for version control and Pull Request management.

tobari-immune