The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes build, test, and lint commands derived from the target repository's configuration files (such as package.json, Cargo.toml, or go.mod). If a malicious repository is audited, these project-defined scripts can execute arbitrary and potentially harmful shell commands on the host system via the Bash tool during the "Gates" phase.
[REMOTE_CODE_EXECUTION]: The skill constructs a complex JavaScript workflow script at runtime by filling a template with user-provided context and repository-derived data. This generated script is then executed by the Workflow tool. This dynamic generation and execution of code increases complexity and could be exploited to run unintended logic if the metadata or project context used to fill the template is maliciously crafted.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted code and documentation from the audited repository and includes it in the context of multiple "Finder," "Verifier," and "Critic" agents. There is no evidence of robust sanitization or delimiters to prevent embedded malicious instructions in the audited code from influencing agent behavior.
Ingestion points: Repository content is ingested via the Read, Glob, and Grep tools, and command output from the Bash tool is used as evidence.
Boundary markers: Absent; repository content is interpolated directly into prompts for secondary agents without isolation or "ignore instructions" warnings.
Capability inventory: Agents have access to Bash execution, further Agent spawning, and the Workflow tool.
Sanitization: Absent; the skill does not validate or escape content from the audited repository before processing it.
[DATA_EXFILTRATION]: The skill includes specific audit dimensions, such as "hygiene" and "secrets-handling," designed to search for and read environment files (.env) and hardcoded credentials (API keys, tokens, and private keys) using shell commands like git ls-files and grep. While the skill mandates redacting these values in the final report, the agents themselves access and process the raw sensitive data during the audit process.

go-live-audit