The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection during the scaffolding process. It reads configuration data from the repository (e.g., package.json, Makefile, turbo.json) and interpolates this untrusted data into the generated verify skill's command blocks (STACK_UP, REGRESSION_CMDS).
Ingestion points: Discovery of stack launchers, regression checks, and auth helpers from repository files in SKILL.md (Steps 0 and 1).
Boundary markers: Absent. The skill does not use specific delimiters or warnings in assets/verify.template.md to prevent the agent from obeying instructions embedded in the discovered strings.
Capability inventory: The generated skill has the capability to execute shell commands and spawn sub-agents with instructions.
Sanitization: None detected. The discovered strings are directly placed into the template placeholders.
[COMMAND_EXECUTION]: The generated skill is designed to execute arbitrary commands discovered from the local environment, such as STACK_UP and REGRESSION_CMDS. While this is the intended functionality for a verification tool, it relies on the integrity of the repository's configuration files.
[EXTERNAL_DOWNLOADS]: The skill uses npx to verify and potentially install the Playwright CLI tool (npx --yes @playwright/cli --version). Playwright is a well-known automation tool provided by Microsoft.

verifier-setup