The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data by reading and grepping through a user-provided codebase, including source files, manifests (e.g., package.json, pyproject.toml), and documentation.
Ingestion points: Project files are read using the read and grep tools during the Discover phase (references/existing-project.md).
Boundary markers: The skill employs a strong human-in-the-loop mitigation strategy, explicitly instructing the agent to 'STOP and wait' to verify assumptions with the user before testing and to triage findings before implementing fixes.
Capability inventory: The agent has access to bash, write, and edit tools, which can be used to execute commands or modify files based on analyzed content.
Sanitization: No explicit sanitization of file content is performed; the skill relies on the multi-phase verification and triage process to prevent the agent from blindly following instructions embedded in the analyzed code.
[DYNAMIC_EXECUTION]: The skill executes shell commands for building the application, installing dependencies, and running test suites (e.g., npm install, pytest, tsc) based on the contents of the target project's manifest files (references/test-battery.md). While functional for auditing, this involves executing code defined in the untrusted project being analyzed.
[COMMAND_EXECUTION]: The skill utilizes several shell commands (ls, find, grep, curl, mkdir) to explore the file system and probe local network endpoints for API testing. These operations are scoped to the project environment and are used to gather data for the audit report.

app-design