The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute npx -y lagune@latest pull if the security tool is not already available. This is a standard method for invoking Node.js-based utilities from the public npm registry.
[EXTERNAL_DOWNLOADS]: The skill references documentation and manifests from lagune.ai and poku.io. These are used to guide the agent in applying security best practices and running tests.
[INDIRECT_PROMPT_INJECTION]: The skill defines rules for processing and modifying source code, creating a surface for indirect prompt injection if malicious instructions are embedded in the project files the agent analyzes.
Ingestion points: Project source files and commit contexts.
Boundary markers: Not explicitly defined; the skill relies on the agent's internal context management.
Capability inventory: Shell command execution via npx and file system operations (writing/modifying code).
Sanitization: No specific sanitization logic is implemented within the skill instructions.

engineering