The Agent Skills Directory

[COMMAND_EXECUTION]: The record command, implemented in scripts/record_run.py, executes arbitrary command-line arguments provided by the agent via subprocess.run. This provides a powerful shell execution capability within the target repository's environment. While functionally intended for running and recording test results, there are no restrictions on the binaries or arguments the agent can invoke.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from external sources, specifically GitHub issue descriptions (gh issue view <n>) and project blueprints (.first-four-hours/blueprints/*/blueprint.md). These sources represent an attack surface where an adversary could embed instructions designed to trick the agent into executing malicious commands via the record tool.
Ingestion points: gh issue view output and local blueprint markdown files are read into the agent's context in SKILL.md step 2.
Boundary markers: The instructions provide some guidance to "Link or quote its intent... never re-author them," but do not include explicit delimiters or warnings to ignore embedded instructions.
Capability inventory: The agent has access to arbitrary command execution (scripts/record_run.py), file read access via git diff, and the ability to create/edit pull requests using the GitHub CLI (gh).
Sanitization: There is no evidence of sanitization or filtering of the instructions ingested from issues or blueprints before they influence the agent's decision on which verification commands to run.
[DYNAMIC_EXECUTION]: The internal runtime script scripts/_skill_protocol_runtime.py uses importlib.import_module to dynamically load the diagnostic contract module at runtime.

pr