The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because its primary function is to ingest and analyze external code files that may contain hidden instructions.
Ingestion points: File contents are read using the file_read tool in Phase 1 of the review process.
Boundary markers: The skill instructions do not specify any delimiters or safety warnings to prevent the model from following instructions embedded within the analyzed code.
Capability inventory: The skill possesses the bash tool, which can execute system commands, and the file_read tool for accessing the local file system.
Sanitization: There is no process for sanitizing or escaping the content of the files before they are processed by the agent.

code-review