The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands including jq, git clone, git fetch, and rm -rf. While these are standard development tools, the use of rm -rf for cleanup carries a risk of accidental data loss if path variables are mismanaged or manipulated.
[DYNAMIC_EXECUTION]: The instructions explicitly encourage the agent to 'run their tests' and 'write scripts' against external source code cloned into the .agent-sources/ directory. This pattern represents the execution of untrusted third-party code.
[INDIRECT_PROMPT_INJECTION]: The skill workflow involves reading and processing external source code, which serves as an ingestion point for untrusted data.
Ingestion points: External Git repositories cloned into the local .agent-sources/ folder.
Boundary markers: The skill does not define specific delimiters or instructions to treat the external source code as untrusted or to ignore embedded instructions.
Capability inventory: The agent is empowered to clone repos, read files, and execute shell commands/scripts within the cloned project context.
Sanitization: There are no sanitization or validation steps mentioned to verify the safety of the external code before it is analyzed or executed.

agent-sources