The Agent Skills Directory

[COMMAND_EXECUTION]: The skill requests broad tool permissions including Bash(security:*), Bash(scan:*), and Bash(audit:*), along with file system Write and Edit capabilities. This allows the agent to execute shell commands and modify files based on its analysis of the codebase.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from the local codebase to perform its primary function.
Ingestion points: The skill identifies and reads files within the project's base directory ({baseDir}/) to assess security compliance.
Boundary markers: There are no explicit instructions or delimiters used to prevent the agent from following instructions that might be embedded within the source code or documentation files it reads.
Capability inventory: The agent has access to shell commands (Bash) and file modification tools (Write, Edit), which could be abused if an attacker places malicious instructions in a file the skill is expected to scan.
Sanitization: The skill instructions do not specify any validation or sanitization steps for the content retrieved from the codebase before it is used to determine subsequent actions.

checking-owasp-compliance