The Agent Skills Directory

[Indirect Prompt Injection] (HIGH): The skill ingests untrusted data from repository files and processes it via an AI subagent to generate fix plans.
Ingestion points: The skill reads all SKILL.md files in the repository as part of its core validation workflow.
Boundary markers: No explicit delimiters or instructions are provided to the subagent to disregard natural language instructions found within the scanned data.
Capability inventory: The agent has access to Edit, Bash, and Task tools, allowing it to modify the filesystem and execute commands based on potentially malicious input.
Sanitization: There is no evidence of sanitization or filtering of the scanned file content before it is passed to the AI fixer subagent.
[Remote Code Execution] (MEDIUM): The workflow requires running npm install and executing a local TypeScript script (validate-links.ts) using npx tsx.
While the listed dependencies in package.json are common, the actual logic of the validation script is not provided for inspection, posing a risk if the script is modified by an attacker in the repository.
[Command Execution] (LOW): The skill uses the Bash tool to run validation scripts and install dependencies, which is a powerful capability that could be abused if the script logic is compromised or manipulated via injection.
[Data Exposure] (LOW): The skill performs external network requests (HTTP HEAD) to verify URLs. While legitimate for its purpose, this network capability could be misused to probe internal infrastructure or perform basic SSRF.

umbraco-skill-validator