The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill contains numerous examples of dynamic execution sinks such as eval(), exec(), unserialize(), and pickle.loads() across multiple reference files (e.g., references/lang-python.md, references/lang-ruby.md, references/language-specific.md). These are explicitly documented as 'DANGEROUS' patterns for the agent to identify during code reviews and are not part of the skill's own execution logic.
[COMMAND_EXECUTION]: Files like references/lang-php.md and references/lang-ruby.md include examples of shell command injection, such as system("ls " . $_GET['dir']) and rm -rf /. These are clearly labeled as vulnerabilities for analysis training and are contained within markdown code blocks.
[INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface for indirect prompt injection because the sharp-edges-analyzer agent is designed to ingest and analyze untrusted user data (API designs and source code).
Ingestion points: The agent reads external files using the Read, Grep, and Glob tools.
Boundary markers: The skill body provides instructions on identifying sharp edges but does not define specific output delimiters for the analyzed content.
Capability inventory: The skill's frontmatter explicitly restricts allowed-tools to Read, Grep, and Glob, which significantly limits the risk by preventing the agent from executing shell commands or making network requests based on injected instructions.
Sanitization: The skill relies on the underlying LLM's instructions to categorize findings rather than automated parsing, meaning the 'sanitization' is handled by the agent's internal reasoning process.
[SAFE]: All external resource references, such as mentions of libsodium, OpenSSL, and common package registries, are standard industry references. The author 'trailofbits' is a known security research entity, and the content of the skill aligns perfectly with its stated purpose of identifying security 'footguns'.

sharp-edges