The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and audit untrusted Rust source code, which presents a vulnerability surface for indirect prompt injection.
Ingestion points: The skill reads *.rs files, README files, and configuration files like Cargo.toml from the user's repository via the Read and Bash tools.
Boundary markers: The instructions do not explicitly mandate delimiters or 'ignore embedded instructions' warnings for the data passed to sub-agents, though sub-agents have their own internal protocols.
Capability inventory: The orchestrator and sub-agents have access to powerful tools including Bash, Write, and Edit to perform the audit.
Sanitization: There is no explicit mention of sanitizing or escaping the source code content before processing it with the LLM.
[DYNAMIC_EXECUTION]: The skill uses python3 to execute scripts (build_run_plan.py, validate_artifacts.py, generate_sarif.py) that are located using dynamic path resolution.
The variable RUST_REVIEW_PLUGIN_ROOT is resolved by searching for a specific marker file (prompts/clusters/unsafe-boundary.md) in home directories and the current working directory.
While the resolution logic prioritizes installed home directories to mitigate risks, running the tool in a 'fallback' mode within an untrusted repository could potentially lead to the execution of scripts provided by the audited repository if they mimic the expected plugin structure.

rust-review