The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze manifest files (like package.json, Cargo.toml) from untrusted projects, creating a surface for embedded malicious instructions to influence the agent's behavior.
Ingestion points: The skill uses read_file, codex_read_file, and codebase_search to access the full project directory.
Boundary markers: The system prompt in agents/openai.yaml does not define clear delimiters or instructions to ignore instructions found within the analyzed files.
Capability inventory: The agent is equipped with the bash tool and multiple shell commands (npm, pip, cargo, poetry), which could be misused if the agent is manipulated by data content.
Sanitization: There is no evidence of filtering or sanitization of content read from the codebase before it is processed by the model.
[COMMAND_EXECUTION]: The skill requires access to the bash shell and various package management CLI tools. While these are necessary for its stated purpose of auditing dependencies, they provide a broad execution environment that requires careful monitoring during operation.

dependency-analyst