The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute specific shell commands to analyze the project, including find lib/ -type f -name '*.dart' | head -100 for file exploration, grep -r "import.*features/" lib/features/ for dependency scanning, and find lib/ -name "*.dart" -exec wc -l {} + for measuring file sizes. These commands are diagnostic and run within the local project context.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) because it processes user-provided Flutter source code from the lib/ directory and pubspec.yaml as data for analysis. There are no explicit instructions to ignore potentially malicious directions embedded within the code, creating a surface where an attacker could influence the agent's audit results. Mandatory Evidence Chain for Category 8: 1. Ingestion points: lib/ directory and pubspec.yaml. 2. Boundary markers: Absent. 3. Capability inventory: Shell command execution via find, grep, and wc. 4. Sanitization: Absent.

architecture-auditor