The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided Semgrep rules via the rulePath argument. Because this content is interpreted by the agent to perform translations and adaptations, a maliciously crafted rule file could contain embedded instructions intended to override agent behavior or exfiltrate data.
Ingestion points: The contents of the rule file specified by rulePath are read and processed in SKILL.md across multiple phases.
Boundary markers: Absent. The instructions do not specify any delimiters or warnings to ignore instructions embedded within the source rule.
Capability inventory: The agent has access to Bash, Read, Write, Edit, WebFetch, and Workflow tools, providing a significant capability surface if an injection succeeds.
Sanitization: No sanitization or validation of the input rule's content is described beyond Semgrep's own syntax validation.
[COMMAND_EXECUTION]: The skill instructs the agent to use shell commands such as ls and find to discover its own internal references directory within hidden platform directories (e.g., ~/.claude/projects/). It also invokes the semgrep CLI for testing and AST dumping (semgrep --test, semgrep --dump-ast). These operations are consistent with the skill's stated purpose of security tool automation.
[DYNAMIC_EXECUTION]: Static analysis detectors flagged the use of eval and exec in references/language-syntax-guide.md. This is a false positive; these terms appear within markdown code blocks as part of Semgrep pattern examples (e.g., pattern: eval($USER_INPUT)) intended for vulnerability detection, rather than as instructions for the agent to execute code.

semgrep-rule-variant-creator