The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The primary function of this skill is to analyze untrusted source code from a user-provided target directory. This creates a surface for indirect prompt injection, as malicious instructions hidden within the audited code (such as in comments, documentation, or string literals) could potentially be interpreted by the agent as instructions to follow.
Ingestion points: The agent is instructed to read source files using various scripts (sink_census.py, pattern_census.py, trace_sink.py) and perform manual triage and reasoning on findings as described in SKILL.md (Steps 5 and 6).
Boundary markers: The skill does not provide specific instructions to the agent to disregard instructions found within the data being processed, nor does it use clear delimiters to separate untrusted code from instructions.
Capability inventory: The skill has the ability to execute shell commands (python3), install packages (pip), and interact with a local network service (XERJ on 127.0.0.1).
Sanitization: There is no explicit mention of sanitizing or escaping the content read from the codebase before the agent processes it.
[COMMAND_EXECUTION]: The skill instructs the agent to execute several local Python scripts (e.g., sink_census.py, pattern_census.py, enrich_pipeline.py) and use pip to install dependencies. While these are part of the intended audit workflow and involve resources from the author's ecosystem, they represent the execution of external code that is not provided within the skill's own file set.

xerj-security-audit