The Agent Skills Directory

Indirect Prompt Injection (HIGH): The skill processes untrusted file content and presents it directly to the agent's context, creating a significant attack surface. \n
Ingestion points: scripts/sweep.py and various grep commands in SKILL.md read file content from the local codebase. \n
Boundary markers: Absent; results are displayed as plain markdown without delimiters or 'ignore' instructions. \n
Capability inventory: The skill allows the agent to use bash, python, and git, providing a high-impact set of tools if the agent is subverted by malicious input. \n
Sanitization: None; the skill does not filter or escape contents of the scanned TODO or console.log lines. \n- EXTERNAL_DOWNLOADS (LOW): The skill uses npx tsc --noEmit. While npx can download and execute remote packages, typescript is maintained by Microsoft, a trusted source. Per [TRUST-SCOPE-RULE], this download risk is downgraded to LOW, although it remains a runtime dependency. \n- COMMAND_EXECUTION (LOW): scripts/sweep.py uses subprocess.run to execute rg or grep. While it correctly uses argument lists to mitigate shell injection, the skill relies on executing external system utilities to perform its primary function.

loose-ends