The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and follow instructions from untrusted external sources, specifically developer quickstarts, onboarding guides, and sample repositories. This creates a significant surface for indirect prompt injection, where an attacker could embed malicious instructions within a guide to manipulate the agent's actions.
Ingestion points: The agent is instructed to read external entry pages and explore implementation details of third-party repositories (SKILL.md).
Boundary markers: No explicit delimiters or instructions to ignore embedded prompts within the external data are provided.
Capability inventory: The skill allows the agent to execute setup commands and software checks, providing a path for injected instructions to reach the shell (SKILL.md).
Sanitization: No sanitization or validation of the external content is specified.
[COMMAND_EXECUTION]: The instructions explicitly direct the agent to "Execute safe, in-scope setup and software checks when practical." While the skill includes a safety warning to inspect commands before running them (especially those affecting global state or hardware), this still represents a capability to execute code derived from untrusted documentation.

developer-friction