The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection because its core function is to read and analyze untrusted source code and configuration files from external projects.
Ingestion points: The agent loads the entire codebase using the Read and Glob tools as part of the analysis workflow defined in SKILL.md and references/report-structure.md.
Boundary markers: The skill lacks specific instructions or structural delimiters to prevent the agent from following malicious instructions that might be embedded within the audited files (e.g., comments or documentation designed to subvert the agent's logic).
Capability inventory: The agent has significant capabilities, including the Bash tool, Grep, TaskCreate, and Read across the filesystem.
Sanitization: No sanitization or content filtering is performed on the ingested code before analysis.
[COMMAND_EXECUTION]: The skill executes a local shell script (scripts/estimate-tokens.sh) using the Bash tool to calculate codebase metrics. While the script is part of the skill, its execution relies on project paths, which requires the agent to handle directory names safely to avoid command injection.
[EXTERNAL_DOWNLOADS]: The documentation (references/dependency-audit-guide.md) directs the agent to utilize standard security tools like npm audit, pip-audit, and govulncheck. These are well-known industry standards used for their intended security-auditing purposes.

audit-full