The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill monitors and processes files within the codebase (e.g., ./src/, ./worktrees/) to generate quality reports. This creates a surface for indirect prompt injection where malicious instructions embedded in source code could be interpreted by the agent during analysis.
Ingestion points: The FileMonitor class in scripts/run_qa-service.py reads all files in the watched directories to calculate MD5 checksums. Additionally, the agent uses codex_read_file to analyze content.
Boundary markers: No boundary markers or 'ignore' instructions are present to delimit untrusted codebase content from agent instructions.
Capability inventory: The agent has access to high-privilege tools including bash, write, and codex_write_file across the project directory.
Sanitization: The skill does not perform sanitization, filtering, or validation of the file content before it is processed by the analysis engine or the LLM.
[COMMAND_EXECUTION]: The agent configuration in agents/openai.yaml includes the bash tool, granting the ability to execute arbitrary shell commands on the host system. While intended for service management, this capability increases the impact of other vulnerabilities like prompt injection.

qa-service