The Agent Skills Directory

[PROMPT_INJECTION] (HIGH): The skill is highly vulnerable to Indirect Prompt Injection (Category 8) because it is designed to ingest and process untrusted codebase content.
Ingestion Points: Subagents read project files using Read, Grep, and Glob across all discovered directories in scripts/deep_research.sh.
Capability Inventory: Subagents are explicitly granted the Bash tool in the generate_subagents_json function, providing a direct path to system command execution.
Boundary Markers: None identified; the skill does not use delimiters or specific instructions to prevent the agent from obeying commands embedded in source code or documentation.
Sanitization: None; codebase content is directly interpolated into agent context.
[COMMAND_EXECUTION] (HIGH): The skill metadata in SKILL.md and the subagent generation logic in scripts/deep_research.sh explicitly allow the Bash tool. While the primary script attempts to use --permission-mode plan as a mitigation, the skill's structure encourages spawning agents with shell access that can be exploited via the aforementioned injection vector.
[DATA_EXFILTRATION] (MEDIUM): Because the skill aggregates information into persistent documentation files (e.g., CLAUDE.md, references/), an attacker could use indirect prompt injection to force the agent to read sensitive local files (like .env or SSH keys) and write their contents into the publicly visible research artifacts.

codebase-researcher