The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in references/audit.md (Step 2) direct the agent to collect measurements through the host shell using playbook-defined commands. This includes executing test suites, listing tests, and using GitHub CLI tools (gh run list, gh api) to retrieve CI data.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources, including project manifests, test configuration files, and API responses from GitHub. This surface could be exploited to influence agent behavior during command execution. Evidence is found in SKILL.md and references/audit.md, where the skill reads manifests and configurations to drive discovery and auditing tasks. No boundary markers or sanitization procedures for these inputs are described in the instructions.\n- [EXTERNAL_DOWNLOADS]: The skill fetches CI run information and report artifacts from GitHub via the gh CLI as documented in references/audit.md. This is a routine fetch of configuration and state from a well-known service.

test-preparation