The Agent Skills Directory

[PROMPT_INJECTION]: The skill architecture is susceptible to indirect prompt injection due to its core function of processing and analyzing untrusted external codebase data.
Ingestion points: Untrusted data enters the agent's context when it reads files, performs searches, or greps content using the Read, Glob, and Grep tools across various auditing and review workflows as described in SKILL.md.
Boundary markers: The instructions lack specific delimiters or explicit warnings to the agent to ignore potentially malicious instructions embedded within the processed code (e.g., comments designed to hijack agent behavior).
Capability inventory: The skill environment has access to powerful tools including Bash for command-line operations, Task for spawning and controlling additional agents, and mcp5_create_entities for managing state and memory, all of which could be misused if an injection is successful.
Sanitization: No evidence of sanitization, validation, or escaping of external content is present in the skill's operational logic before the data is interpreted by the lead agent or passed to specialized sub-agents.

equilateral-agents-refactored