The Agent Skills Directory

[PROMPT_INJECTION] (HIGH): Vulnerable to Indirect Prompt Injection (Category 8) due to the combination of untrusted data ingestion and file modification capabilities.\n
Ingestion points: The script scripts/generate-docs.sh uses Read, Glob, and Grep tools to scan the entire contents of the target $PROJECT_DIR.\n
Boundary markers: Absent. The prompt does not define strict boundaries between its instructions and the data read from project files.\n
Capability inventory: The agent is granted Write and Edit tools, allowing it to modify any file in the project directory.\n
Sanitization: Absent. Input from project files is processed directly by the model without escaping or validation.\n- [PROMPT_INJECTION] (MEDIUM): The script explicitly overrides safety confirmations to support automation.\n
Evidence: In scripts/generate-docs.sh, the prompt instructs: 'You are running in headless/CI mode. Do not ask for user confirmation at any point.' This removes a critical human-in-the-loop safety check in the event of an injection attack.\n- [COMMAND_EXECUTION] (LOW): The script executes shell commands via the Claude CLI but applies strict limitations.\n
Evidence: The --allowedTools flag in scripts/generate-docs.sh limits bash execution to a specific whitelist: ls, git, tree, wc, and mkdir. This implementation of the principle of least privilege effectively mitigates the risk of arbitrary command execution.

superdocs