The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it is designed to ingest and act upon untrusted data from the repository being analyzed.
Ingestion points: The agent reads source code, test assertions, build configurations, and .config/dotnet-tools.json as specified in SKILL.md and references/execution.md.
Boundary markers: The instructions do not include specific boundary markers, delimiters, or guidance for the agent to ignore potentially malicious instructions embedded within the source files or test data.
Capability inventory: The skill possesses the capability to execute shell commands (e.g., dotnet test, dotnet stryker), perform builds, and modify the file system by creating worktree snapshots.
Sanitization: There is no evidence of input validation, escaping, or sanitization of the content read from the repository before it is used to influence the agent's actions.
[COMMAND_EXECUTION]: The skill involves the execution of build and test commands based on repository-defined configurations.
Evidence: SKILL.md and references/execution.md instruct the agent to run dotnet stryker and execute existing test and build commands found within the project environment. While these are necessary for the skill's primary function, they provide an execution path for instructions derived from untrusted project files.

dotnet-mutation-testing