The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the user ($request) and the project codebase (via Read and Glob tools). While it enforces a disciplined 'reproduce-diagnose-fix-verify' loop, it lacks explicit boundary markers (e.g., XML tags or delimiters) to separate instructions from untrusted data, potentially allowing malicious code in the repository to influence the agent's actions.
Ingestion points: The $request argument in SKILL.md and codebase files read from the local filesystem using Read or Glob tools.
Boundary markers: Absent. The skill does not define specific delimiters to isolate user-supplied or file-based content from its internal logic.
Capability inventory: The skill utilizes Bash (command execution), Write, and Edit (filesystem modification) across its scripts.
Sanitization: The skill mitigates risks by requiring a failing reproducer and smallest correct change, ensuring modifications are verified against expected behavior, though no technical sanitization of raw input is performed.

bugfix