The Agent Skills Directory

[PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill scans the local filesystem and reads project configuration files (Step 0) to detect the tech stack and existing tests. This data is untrusted and could contain malicious instructions designed to alter the agent's behavior.
Ingestion points: Reads files such as package.json, jest.config.*, and .github/workflows/ using Read, Glob, and Grep tools.
Boundary markers: None present. The skill does not implement delimiters or specific warnings to ignore embedded instructions in the files it analyzes.
Capability inventory: The skill has access to powerful tools including Bash, Write, WebFetch, and Edit across its operations.
Sanitization: No sanitization or validation of the content read from the codebase is specified before it is processed in the prompt context.
[COMMAND_EXECUTION]: Shell Tool Authorization. The skill is granted access to the Bash tool for environmental discovery and scanning. While the instructions focus on benign identification of test frameworks, the capability to execute shell commands combined with the ingestion of untrusted codebase data represents a standard attack surface for command injection if an attacker can control the file content being scanned.

proof-strategy