The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The script scripts/validate_makefile.sh fetches and installs the mbake package from the official PyPI registry at runtime. While this is necessary for the skill's formatting and linting capabilities, the installation is unversioned, which creates a dependency on the availability and integrity of the external registry.\n- [COMMAND_EXECUTION]: The skill performs syntax validation using make -n (dry-run mode) on user-provided files. GNU Make evaluates $(shell ...) expansions during the variable evaluation phase even when the dry-run flag is set, which allows a maliciously crafted Makefile to execute arbitrary shell commands in the agent's environment when it is being 'validated'.\n- [COMMAND_EXECUTION]: The documentation file docs/common-mistakes.md contains a reference to a destructive rm -rf / command used as an example of a build system error to avoid; this instance is purely instructional and does not pose a runtime risk.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Makefiles and passes them to system tools without implementing security boundaries or sanitization.\n
Ingestion points: User-specified Makefile paths provided to the validate_makefile.sh script.\n
Boundary markers: Absent. The skill does not employ delimiters or explicit instructions to prevent the execution of malicious logic embedded in the Makefile content.\n
Capability inventory: The skill environment allows shell command execution (via make), package installation (via pip3), and broad file system interaction (via grep).\n
Sanitization: Absent. The raw content of the provided Makefile is evaluated directly by the syntax checker and linter tools.

makefile-validator