The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data by cloning and reading source code from external GitHub repositories provided by the user. This creates an attack surface where a malicious repository could contain instructions designed to influence the agent's behavior or output during the scanning process.
Ingestion points: Clones repository content using git clone into a temporary directory (/tmp/ or %TEMP%) and subsequently reads source files for analysis (SKILL.md).
Boundary markers: The skill contains explicit safety instructions: "此為靜態分析，不執行任何程式碼" (This is static analysis, do not execute any code) to prevent the agent from executing content found in the target repositories.
Capability inventory: The skill utilizes git (log, ls-files), gh (repo view, issue list/view), and ls tools to inspect repository structure and history.
Sanitization: The instructions guide the agent through a structured 6-phase process, focusing on pattern matching for known vulnerabilities and maintainer assessment rather than free-form interaction with the code.
[EXTERNAL_DOWNLOADS]: The skill performs external downloads as part of its primary auditing function.
Evidence: The skill uses git clone --depth 50 {repo_url} to fetch repository content for the analysis phases (SKILL.md).
Source: The target URLs are provided by the user and typically point to GitHub, which is a well-known service. This behavior is consistent with the skill's stated purpose of auditing open-source projects.

scan-repo