The Agent Skills Directory

Indirect Prompt Injection (HIGH): The skill is designed to process external, untrusted Qt project files which serves as a major injection vector.
Ingestion points: The projectPath parameter allows the agent to ingest arbitrary source code, QML files, and build configurations.
Boundary markers: There are no specified delimiters or instructions to ignore embedded natural language instructions within the source code being audited.
Capability inventory: The skill has access to Bash, Read, Grep, and Glob. The Bash tool is particularly dangerous if the agent is tricked into compiling or running a malicious project.
Sanitization: No sanitization or validation of the input files is described in the skill logic.
Command Execution (MEDIUM): The inclusion of Bash in allowed-tools combined with the capability 'Test with platform accessibility tools' suggests the skill may execute build commands or platform-specific binaries. If the audited project contains malicious build scripts (e.g., a poisoned project.pro or CMakeLists.txt), it could lead to arbitrary code execution on the host.
Data Exposure (LOW): The Read and Glob tools allow the agent to browse the local filesystem. While necessary for auditing, an attacker could use indirect prompt injection to redirect these tools toward sensitive files like ~/.ssh/id_rsa or .env files within the project directory.

qt-widget-accessibility-audit