The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because its primary function is to process and react to instructions found within code comments (e.g., 'do not remove', 'do not change wording'). Maliciously crafted comments in user code could potentially influence the agent's behavior during the analysis phase.
[INDIRECT_PROMPT_INJECTION]: Mandatory Evidence Chain: 1. Ingestion points: The skill reads the 'caller's files or diff' and the 'current diff against the base branch'. 2. Boundary markers: No delimiters or protective warnings are defined for the ingested code content. 3. Capability inventory: The skill can modify files (delete comments, implement fixes), spawn subagents ('comment-sicko'), and execute specialized architectural and discovery commands ('/architect', '/how', '/why'). 4. Sanitization: There is no process described for sanitizing or filtering the content of the code or comments before processing.
[COMMAND_EXECUTION]: The skill manages the lifecycle of a subagent ('Task' with 'subagent_type: "comment-sicko"') and invokes several internal commands such as '/architect', '/how', and '/why' to perform code analysis and refactoring tasks.
[DATA_EXFILTRATION]: The skill instructions contain a directive to read a file located at '../orca-harness/SKILL.md' if the 'ORCA_CLI_COMMAND' environment variable is set. This indicates access to the file system outside of the skill's immediate directory structure.

no-comments