The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is instructed to ingest and process data from untrusted external sources (the local codebase) that could contain malicious instructions.
Ingestion Points: Reads repository documentation (README, CONTRIBUTING.md), dependency manifests (package.json), and CI/CD configurations (.github/workflows/).
Boundary Markers: Absent; the instructions do not define delimiters or specific 'ignore' directives for content within the audited files.
Capability Inventory: Access to Bash (shell execution), Read (file access), and WebFetch (network operations).
Sanitization: No explicit sanitization or validation of the contents of the audited files is described before processing.
[DATA_EXFILTRATION]: The skill instructions direct the agent to access potentially sensitive project configuration files including CI/CD workflows and deployment scripts. When combined with the availability of network tools like WebFetch, this creates a potential data exposure surface, though no specific exfiltration commands are present.
[COMMAND_EXECUTION]: Utilizes Bash to perform environment detection, measure build speeds (incremental and full), and execute test suites as part of the DX audit process.
[EXTERNAL_DOWNLOADS]: The skill is configured to use WebFetch and WebSearch to gather data, although no specific remote URLs are hardcoded in the skill's logic.

pave-audit