The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted repository data (code targets and diffs). It acknowledges this risk in references/runtime-trust.md, explicitly stating that repository content must be treated as untrusted data and cannot alter the agent's scope, authority, or rules.
Ingestion points: The primary input is the Axum review target or diff provided by the user in the agent's context.
Boundary markers: The runtime-trust.md file serves as a meta-instruction to maintain boundaries between the analyzed data and the agent's operational logic.
Capability inventory: The skill allows for command execution (e.g., running service tests) but mandates that this occurs only under explicit authority with the repository set to read-only, network access disabled, and secrets scrubbed.
Sanitization: The instructions emphasize reporting findings rather than executing embedded logic, and require re-reading cited lines to ensure findings are actionable and do not expose internal details.
[DATA_EXFILTRATION]: The skill contains multiple explicit instructions to prevent data leakage. SKILL.md mandates that findings must never expose secrets or internal error values. references/runtime-trust.md requires that secret values remain unread where possible and are never copied into outputs, logs, or evidence records.
[COMMAND_EXECUTION]: The skill describes a controlled process for executing code for testing purposes. It requires that execution is bounded, occurs only under explicit authority, uses a read-only repository, and has network access disabled. These restrictions are designed to prevent arbitrary or malicious command execution during the review process.

tailrocks-axum-review