The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The scripts/inspect-project.py tool reads the contents of all files within a target repository root using root.rglob('*'). The results of this scan are output as JSON, which the agent is then instructed to use as 'review leads' in Step 2 of the workflow. Since the script does not sanitize or escape the content it reads before including it in the output findings, an attacker could craft a file with malicious text that, when matched by the scanner's regex, injects instructions or misleading data into the agent's context. Findings are documented for: Ingestion points (scripts/inspect-project.py), Capability inventory (agent uses results for security review), and the lack of boundary markers or sanitization in the data processing flow.- [METADATA_POISONING]: The skill's YAML frontmatter contains createdBy and updatedBy fields attributing the work to 'github-copilot/gpt-5.6-sol'. This model name is fictitious and constitutes misleading metadata regarding the skill's origin and authorship.

csidh-ctidh