The Agent Skills Directory

[SAFE]: The skill instructions and tool definitions do not contain any malicious patterns such as credential exfiltration, remote code execution, or unauthorized network access. The functionality is restricted to refactoring tasks within the agent's environment.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process and refactor source code, which constitutes an ingestion point for untrusted data. While this is inherent to the skill's primary purpose, the following characteristics define its attack surface:
Ingestion points: Source code is read into the agent's context using tools like refactor_tool and get_minimal_context_tool (SKILL.md).
Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded prompts within the code being analyzed.
Capability inventory: The skill includes the apply_refactor_tool, which grants the agent the ability to write changes to the filesystem.
Sanitization: There are no instructions for sanitizing or validating the code content against malicious prompts before processing.

refactor-safely