The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external, untrusted data including pull request diffs, commit messages, and library source code (Steps 1 and 3). There is an absence of explicit boundary markers or sanitization instructions to prevent the agent from following malicious instructions potentially embedded in this external content.
Ingestion points: PR diffs, commit history, and library source code (referenced in Steps 1 and 3).
Boundary markers: None specified in the instructions.
Capability inventory: Writing and executing scripts or tests (Step 5), and performing symbol/grep searches (Steps 1 and 3).
Sanitization: No mention of escaping or validating external content before processing.
[DYNAMIC_EXECUTION]: Step 5 explicitly directs the agent to "Write a script or test that runs the real code, run it, and paste what happened." This involves the runtime generation and execution of code based on the agent's analysis of the local codebase and external PR data.
[COMMAND_EXECUTION]: The skill requires the agent to execute shell commands such as grep and the execution of generated scripts/tests to verify the safety of changes. When these commands are triggered by the analysis of untrusted data, it creates a risk of command injection or manipulation if the agent's logic is subverted.

blast-radius