The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted content from user-provided skill or rule files to automatically generate behavioral specifications, test scenarios, and sandbox setup commands. An attacker could craft a malicious skill file to influence the LLM's output, potentially leading to the generation of unintended setup commands or agent prompts.
Ingestion points: Skill/rule file path provided via the CLI in scripts/run.py.
Boundary markers: Prompt templates in the prompts/ directory wrap external skill content with triple-dash (---) delimiters to help the LLM distinguish instructions from data.
Capability inventory: The skill can execute shell commands via subprocess.run (in scripts/runner.py for sandbox setup) and invoke the claude agent with Bash, Write, and Edit tools enabled.
Sanitization: scripts/runner.py employs a _safe_sandbox_dir function that uses path.resolve().relative_to() to verify that all sandbox operations are confined to /tmp/skill-comply-sandbox, effectively preventing path traversal attacks.
[COMMAND_EXECUTION]: The skill uses the subprocess module to execute external binaries and shell commands. It invokes the claude CLI for several tasks, including tool call classification and scenario execution. It also runs git init and LLM-generated setup_commands during the creation of test environments. The skill mitigates risks by using shlex.split for argument parsing and avoiding shell=True, but the execution of commands derived from LLM interpretation of untrusted files remains a noteworthy security boundary.

skill-comply