The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill includes instructions to execute npx -y @sourcemeta/jsonschema, which involves downloading and running an external package from the NPM registry. This dynamic execution of unpinned remote code creates a supply chain security risk.
[INDIRECT_PROMPT_INJECTION]: The skill processes markdown files from the docs/solutions/ directory and passes their contents to subagents for investigation and classification. This creates a surface for indirect prompt injection if the files contain malicious instructions.
Ingestion points: Markdown files in docs/solutions/, CONCEPTS.md, and repository instruction files like AGENTS.md or CLAUDE.md (as referenced in references/verify-claims.md and references/discoverability.md).
Boundary markers: The skill does not implement specific delimiters or instructions to ignore embedded prompts when passing content to subagents.
Capability inventory: Operations include git mv, git log, git show, gh pr view, and file writing/deletion across the repository.
Sanitization: The skill applies YAML syntax checks, which validate structural integrity but do not sanitize natural language content for potential injection attacks.
[COMMAND_EXECUTION]: The skill utilizes several command-line tools including git, gh (GitHub CLI), and awk to audit the repository. While these are necessary for the skill's functionality, they provide a broad range of capabilities that could be exploited if the agent's logic is subverted.
[DYNAMIC_EXECUTION]: The skill uses shell scripts to process and validate file contents at runtime and dynamically spawns subagents with instructions derived from data found in the repository. This runtime assembly and execution of logic increases the potential for unexpected behavior if malicious data is encountered.

learn-with-docs-refresh