The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data, including codebases, specifications, and pull request documentation, creating a potential surface for indirect prompt injection.
Ingestion points: The agent reads project files, document paths, and branch content as part of the mission contexts.
Boundary markers: The skill mitigates risks by running missions in "fresh contexts" using subagents, providing isolation between the target code analysis and the primary agent session.
Capability inventory: The skill possesses capabilities to read files, write reports to a designated .scratchpad/ directory, and execute user-defined deterministic checks like linters or mutation tests.
Sanitization: No specific content escaping or sanitization is mentioned for the ingested data.
[COMMAND_EXECUTION]: The skill facilitates the execution of development and security tools but implements strict oversight controls.
It explicitly forbids the agent from autonomously searching for or executing tools, requiring that all commands for deterministic checks (mutation testing, audits) be provided by the user or pre-configured in adjustments.
It mandates the use of git worktree within a .scratchpad/ directory for all code probes, ensuring that the primary working directory and shared environments are protected from side effects.
[SAFE]: The skill includes several security best practices, such as verifying findings with an independent subagent and performing integrity checks on configuration files like .agents/yesyak.json against the base branch version.

red-team-review