The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external codebases (Python, JavaScript, Rust, etc.) to provide context for an LLM. An attacker could introduce malicious instructions or 'jailbreak' strings within symbol names (e.g., function or class names) or documentation within the analyzed files. When the agent executes commands like cm map or cm query, these strings would be included in the tool's output and presented directly to the AI's context window.
Ingestion Points: Source code files in the target project directory (referenced in SKILL.md and references/workflows.md).
Boundary Markers: None mentioned. The output format --format ai is optimized for token efficiency but does not appear to include explicit delimiters to prevent the agent from obeying embedded instructions.
Capability Inventory: The skill uses the cm CLI tool to perform file system reads and analysis across multiple languages.
Sanitization: No sanitization or filtering of extracted symbol names is described in the provided documentation.
[EXTERNAL_DOWNLOADS]: The documentation frequently suggests installing the codemapper tool using cargo install codemapper. This involves downloading and executing code from a well-known package registry.
Evidence: Multiple references in references/integration-examples.md and references/command-reference.md show cargo install codemapper in CI/CD and shell script examples.
[DYNAMIC_EXECUTION]: Integration scripts provided in the documentation use shell patterns that interpolate potentially untrusted data into command execution.
Evidence: In references/integration-examples.md, the 'Change Analysis Context' script pipes the output of cm diff (which contains symbol names from the codebase) into a while loop that executes cm callers "$symbol". If a symbol name is crafted to include shell metacharacters, it could lead to command injection if the variable is not handled securely by the shell executing the script.

codemapper