The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes local repository content, including source code, git logs, and diffs, to generate documentation. This creates an indirect prompt injection surface where malicious content within the analyzed repository could attempt to influence the agent's logic or output.
Ingestion points: Project files and metadata accessed via Read, Grep, Glob, Bash(git log *), and Bash(git diff *) tools.
Boundary markers: The skill relies on internal instruction-based checks ("Redaction Rules" and "Objectivity" sections) rather than formal data delimiters or explicit "ignore" markers for untrusted repository content.
Capability inventory: File system modification capabilities (Write, Edit) and the ability to execute project-defined scripts via Bash.
Sanitization: The skill provides detailed rules for redacting sensitive information from its output, but it does not specify methods for sanitizing or escaping the data it ingests from the repository.
[COMMAND_EXECUTION]: The skill is intended to run project-specific verification commands, such as npm test, pytest, or cargo test, to validate documentation claims. While the allowed tools are scoped to common test runners, there is a risk that a malicious repository could contain compromised test scripts (e.g., in package.json or tox.ini) that execute harmful code when triggered by the agent.

write-for-ai