The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes explicit defensive instructions to prevent prompt injection from the files it audits. Rule 6 in SKILL.md specifically instructs the agent to treat all repository content as data rather than instructions and to record any 'ignore previous instructions' patterns as security findings rather than following them. The static detector flag for this category is a false positive triggered by these defensive measures.
[DATA_EXFILTRATION]: The skill has a mechanism to create GitHub issues using the gh CLI. However, it implements a strict 'Visibility check' in references/closing-the-loop.md that requires the agent to verify if a repository is public and obtain explicit user confirmation before publishing any sensitive findings or security vulnerabilities. It also has a 'Hard Rule' (Rule 4) that strictly prohibits the reproduction of actual secret values (tokens, keys), requiring instead that they be referenced only by location.
[COMMAND_EXECUTION]: The skill is restricted to read-only analysis tools (e.g., tsc --noEmit, npm audit, git log) on the user's primary working tree. Any commands that mutate code are restricted to a disposable, isolated git worktree, preventing accidental or malicious modification of the user's codebase.
[INDIRECT_PROMPT_INJECTION]: As a codebase auditor, the skill naturally ingests untrusted data from repository files. This surface is mitigated by:
Ingestion points: Project files, source code, and documentation (README, ADRs).
Boundary markers: Explicit instructions in Rule 6 to distinguish data from instructions.
Capability inventory: Limited to read-only CLI tools, Git, and GitHub CLI (with confirmation).
Sanitization: Strict prohibition on copying sensitive data into output files.
[REMOTE_CODE_EXECUTION]: The skill does not perform any remote code execution or external script downloads. All tool execution is limited to local project dependencies and standard development binaries.

improve