The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data, which creates a potential vulnerability to indirect prompt injection.
Ingestion points: Audited code files, pull request diffs, and conversation threads as described in SKILL.md.
Boundary markers: Absent. The instructions do not provide specific delimiters or 'ignore embedded instructions' warnings for the data being analyzed.
Capability inventory: The agent is authorized to execute shell commands and tests (SKILL.md) and perform broad file system reads.
Sanitization: No sanitization or validation of the ingested external content is mentioned.
[METADATA_POISONING]: The agents/audit-gap-reducer.md file specifies model: gpt-5 in its frontmatter. As GPT-5 is not a currently available model, this represents deceptive metadata that could mislead users or automated systems about the skill's intended execution environment.
[COMMAND_EXECUTION]: The skill contains a shell script scripts/sync-to-agents.sh that performs file system operations (rsync, mkdir, rm, ln) within the user's home directory to synchronize files across different agent platforms. Furthermore, the SKILL.md instructions explicitly empower the agent to 'Run the smallest relevant check when cheap and permitted,' which involves executing arbitrary shell commands provided by the environment or inferred from the code.

audit-code