The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze data from untrusted external sources (repository files), creating a surface for indirect prompt injection.
Ingestion points: The skill reads arbitrary files from the repository root, manifest files (e.g., package.json, go.mod), and documentation files (e.g., README.md, ARCHITECTURE.md) as specified in Phase 0 and the Core Responsibilities section.
Boundary markers: There are no instructions for the agent to use boundary markers or delimiters when processing file content, nor are there warnings to ignore embedded instructions within the repository data.
Capability inventory: The skill has access to Glob, Grep, and Read tools, and it specifically allows shell access for executing ast-grep commands.
Sanitization: There are no instructions for the agent to sanitize, escape, or filter content retrieved from the repository before processing it or using it to formulate research output.
[COMMAND_EXECUTION]: The skill explicitly permits the agent to use the shell tool to execute ast-grep for syntax-aware pattern matching. While the instructions specify it should be used "one command at a time" and only for ast-grep, this provides an execution surface that could be exploited via command injection if the agent incorporates untrusted data (like file names or code patterns) directly into a shell command string.

repo-research-analyst