The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to load and process entire codebases into the agent's context, which creates a significant surface for adversarial content to influence the agent.
Ingestion points: The Read tool is used extensively in SKILL.md (Step 2) and workflows/audit-full-mapreduce.js to ingest all source files, configurations, and documentation from the target project.
Boundary markers: The skill does not define or use explicit delimiters or specific instructions to separate the audited code from the analysis directives, increasing the risk that the agent may follow instructions embedded in the code (e.g., in comments or text files).
Capability inventory: The skill utilizes powerful tools including Bash, Agent, Workflow, and TaskCreate, which could be exploited if an injection is successful.
Sanitization: No sanitization, filtering, or validation of the ingested codebase content is performed before it is analyzed by the primary agent or sub-agents.
[DYNAMIC_EXECUTION]: Core audit logic and token estimation are performed through external scripts and workflows executed at runtime.
Script execution: SKILL.md executes a local bash script scripts/estimate-tokens.sh using the Bash tool to perform line counts and token estimations.
Dynamic loading: The Workflow tool is used to execute workflows/audit-full-mapreduce.js, which manages the scale-tier sharding logic for large repositories.
Agent spawning: The audit-full-mapreduce.js workflow dynamically spawns multiple sub-agents using the agent() function to process codebase shards and perform adversarial refutation, creating a complex execution chain.

audit-full