The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted input from external pull requests and solver execution logs. The pr-quality-reviewer subagent reads SKILL.md from the PR branch, while the trajectory-analyzer subagent parses trajectory.jsonl files. * Ingestion points: agents/pr-quality-reviewer.md reads target skill documentation; agents/trajectory-analyzer.md reads trajectory logs. * Boundary markers: Not specified in the instructions for reading external files. * Capability inventory: Includes Bash execution for local scripts, file reading, and posting comments to Forgejo. * Sanitization: No explicit sanitization or validation of untrusted content is mentioned.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute local Python scripts in the agent's internal configuration directory (~/.skillhone/), such as eval.py, status.py, static_check.py, and pr.py. While these are part of the core functionality, they involve handling untrusted identifiers like PR numbers.
[DATA_EXFILTRATION]: The pr-quality-reviewer subagent posts analysis results as comments to a Forgejo server via a script. While this is the intended mechanism for delivering reviews, a successful indirect prompt injection attack could potentially use this channel to exfiltrate information from the agent's context into a public PR comment.

skillhone-evaluation