The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to process untrusted external data, including code diffs, pull requests, and commit histories, which serves as a potential ingestion point for malicious instructions.
Ingestion points: The skill reads diffs, PRs, and commits in Step 1 to understand code changes.
Boundary markers: No specific delimiters or instructions to ignore embedded commands in the source data are provided.
Capability inventory: The skill possesses significant capabilities, including the ability to write and execute arbitrary scripts or tests (Step 5) and perform symbol searches across a codebase.
Sanitization: While the skill advises the agent to "strip anything private before it goes anywhere public," it lacks automated sanitization or validation of the input data used to generate test scripts.
[DYNAMIC_EXECUTION]: The core functionality of the skill involves the runtime generation and execution of code to verify safety facts, which is a powerful capability that could be targeted by an attacker.
Evidence: Step 4 and 5 explicitly direct the agent to "Write a script or test that runs the real code, run it, and paste what happened."
Risk: If the agent's logic for generating these scripts is influenced by malicious content within the diff or PR being analyzed, it could lead to the execution of unintended commands.

blast-radius