The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes shell scripts for validating migration artifacts. scripts/validate-migration-report.sh uses grep and awk to verify the structure and content of generated migration reports, while scripts/validate-migration-skill.sh uses sed, grep, and python3 to validate skill frontmatter and directory structure.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted natural-language data from files like AGENTS.md, CLAUDE.md, and .github/copilot-instructions.md. Malicious instructions embedded in these files could attempt to influence the agent during the extraction or report generation phases.
Ingestion points: Instructions in SKILL.md direct the agent to inspect repository-local documentation and workflow files.
Boundary markers: The skill does not define explicit delimiters or 'ignore embedded instructions' warnings for the data it processes.
Capability inventory: The skill has the ability to read existing files, write new markdown files (reports, skills), and execute local validation scripts.
Sanitization: There is no explicit logic for sanitizing or escaping the content read from the repository instruction files.
[DYNAMIC_EXECUTION]: The scripts/validate-migration-skill.sh script executes a Python script from a path that can be dynamically determined by environment variables. It defaults to looking for quick_validate.py within the $HOME/.codex or $CODEX_HOME directories, representing dynamic execution of a local file based on environment configuration.

migrating-agents-md-to-control-flow