The Agent Skills Directory

[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection.
Ingestion points: The skill reads untrusted content from AGENTS.md, README, ADR, docs, package/build metadata, and test names within SKILL.md.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are defined for the ingested content.
Capability inventory: The skill is capable of reading repository files, writing artifacts to local directories (e.g., /tmp or .codex/ as defined in references/artifact-paths.md), and potentially executing local system tools like linters or test runners (as referenced in references/shared-hard-rules.md).
Sanitization: There is no evidence of sanitization or validation of the external content before it is used to establish the review baseline.
[DATA_EXFILTRATION]: The skill accesses project metadata and documentation to construct a context map. It writes artifacts to the local file system in /tmp/wibaek-review/ and the repository root. No evidence of network-based exfiltration or unauthorized access to sensitive credentials was identified.
[COMMAND_EXECUTION]: The skill utilizes the output of local commands, such as build scripts and linters, to provide evidence for its findings. These execution capabilities are limited to standard repository analysis tasks.

wibaek-review-baseline