The Agent Skills Directory

Indirect Prompt Injection (MEDIUM): The skill is designed to read and process external rule files, creating a vulnerability to indirect prompt injection. Ingestion points: prompts/audit-batch.md and prompts/review-single.md ingest file content from a target directory. Boundary markers: The prompts do not use delimiters (like XML tags) to separate untrusted file content from the agent's instructions. Capability inventory: The review-single.md prompt utilizes WebSearch to verify content, which could be manipulated by a malicious file to influence search queries. Sanitization: No automated sanitization is performed on the ingested content before it is processed by the AI.
Security Best Practices (INFO): The config/criteria.json file proactively forbids dangerous patterns such as npm install within the content being audited, reducing the risk of the skill endorsing malicious instructions.

rules-reviewer