The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill's core workflow (Step 5) explicitly directs the agent to generate and execute scripts or tests that run the code under review to prove safety facts. This involves creating and running new executable content at runtime based on the local environment.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data in the form of git diffs, PR content, and library source code. This creates an attack surface where malicious comments or code structures in the analyzed files could attempt to manipulate the agent's logic during verification.
Ingestion points: Git diffs, PR bodies, commits, and library source code (SKILL.md Steps 1 and 3).
Boundary markers: No specific delimiters or "ignore instructions" warnings are defined to separate the untrusted data from the agent's instructions.
Capability inventory: The skill utilizes script execution, shell commands (grep/symbol search), and multi-model querying (SKILL.md Steps 3, 5, and 6).
Sanitization: Instructions advise the agent to "strip anything private" before public output, but no sanitization or escaping of the ingested code itself is mentioned.
[COMMAND_EXECUTION]: The agent is instructed to perform various shell-level operations, including grepping for callers, searching for symbols, and running the generated verification scripts in the local environment.

blast-radius