The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external project files, creating an attack surface for indirect prompt injection.
Ingestion points: scripts/lint_runner.py reads and parses package.json. scripts/type_coverage.py reads the content of .ts, .tsx, and .py source files.
Boundary markers: None. The skill does not use delimiters or instructions to prevent the agent from following commands potentially embedded in the analyzed code or configuration files.
Capability inventory: scripts/lint_runner.py has the capability to execute shell commands via subprocess.run (e.g., npm, npx, ruff, mypy).
Sanitization: None. The lint_runner.py script executes the lint command exactly as defined in a project's package.json without validation.
[COMMAND_EXECUTION]: The scripts/lint_runner.py script performs command execution using subprocess.run. Specifically, it triggers npm run lint, which executes user-defined scripts from package.json. If an agent is directed to run this skill on a malicious repository, it may execute arbitrary attacker-controlled commands.
[PROMPT_INJECTION]: SKILL.md uses high-pressure, imperative language such as 'MANDATORY:', 'Strict Rule:', and 'NOT allowed' to govern agent behavior. This technique is often used in prompt injections to force an agent to ignore its standard constraints or safety guidelines in favor of the skill's specific instructions.

lint-and-validate