The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and analyze potentially untrusted data from the local repository which acts as a primary attack surface.
Ingestion points: The agent is directed to read content from git status, git log, git diff, and various source code files such as API routes and CI workflows.
Boundary markers: The instructions do not specify the use of delimiters or clear directives for the agent to ignore instructions that might be embedded within the files being audited.
Capability inventory: The agent is granted capabilities to read local files and execute git commands based on the audited content, creating a path for malicious content to influence system actions.
Sanitization: There are no requirements for the agent to sanitize or escape the content retrieved from the repository before processing it.

production-audit