The Agent Skills Directory

[METADATA_POISONING]: The file skill-report.json contains a pre-fabricated security audit report that declares the skill as 'safe' and claims that all potential security findings are 'false positives'. This is a deceptive metadata pattern intended to override the judgment of security analyzers and bias the user's perception of the skill's safety.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external YAML and Markdown files (referred to as RVTF artifacts) which contain fields for executable shell commands. An attacker who can influence these data files can cause the agent to execute malicious code.
Ingestion points: The agent reads and processes YAML/Markdown files structured according to the schemas in references/schema.md.
Boundary markers: None. The skill relies on natural language 'gates' (in references/gates.md) which do not provide technical enforcement or sanitization.
Capability inventory: The framework explicitly utilizes shell execution for verification (e.g., pnpm test) and local visualization (rvtf view).
Sanitization: There is no evidence of command sanitization or validation of the verification.command strings before they are passed to the shell.
[DYNAMIC_EXECUTION]: The framework instructs the agent to run shell commands (like pnpm test or rvtf view) based on strings extracted from the processed artifacts. The references/visualization.md file specifically provides a template for launching a local viewer process (rvtf view TRACE) using arguments derived from the input files, which is a classic dynamic execution vulnerability surface.
[COMMAND_EXECUTION]: The skill frequently references the execution of package manager scripts (pnpm test) and framework-specific tooling (rvtf) as part of its core verification workflow, increasing the likelihood that an agent will run unauthorized or dangerous commands if prompted by malicious data input.

tracing-requirements-to-verification