The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill documentation instructs the agent or user to execute pip install gateguard-ai. This package is not from a recognized trusted vendor or organization, making it an unverifiable dependency that could execute arbitrary code during installation or runtime.
[INDIRECT_PROMPT_INJECTION]: The gating logic for both 'Edit' and 'Write' operations requires the agent to 'Quote the user's current instruction verbatim' as part of the fact-finding process. This creates a surface where a malicious user could embed instructions designed to influence the agent's subsequent logic.
Ingestion points: The skill reads the active user instruction and interpolates it into the agent's context as defined in SKILL.md.
Boundary markers: The prompt instructions do not provide specific delimiters (such as XML tags or unique markers) to isolate the user's instruction from the rest of the agent's logic, which may lead the agent to follow instructions contained within the quote.
Capability inventory: The agent has access to powerful tools including Edit, Write, and Bash (which triggers the gate but is also used for investigation via Grep and find).
Sanitization: There is no mechanism described for escaping or sanitizing the user's text before it is re-presented to the agent in the gate's output.

gateguard