The Agent Skills Directory

[PROMPT_INJECTION]: The skill facilitates indirect prompt injection by design, as it relies on instructions and command definitions provided in the repository's own configuration files.
Ingestion points: The agent reads execution logic and command lists from files located at .claude/repo-profile.md and .claude/verify/config.ts within the repository being processed.
Boundary markers: The instructions do not establish boundary markers to distinguish trusted instructions from potential malicious payloads in the repository configuration.
Capability inventory: The engine possesses shell command execution capabilities through a cmd() function defined in its internal scenario logic.
Sanitization: There is no evidence of sanitization or strict validation of the command strings fetched from the repository configuration before they are passed to the shell.
[COMMAND_EXECUTION]: The primary function of the skill is to execute arbitrary shell commands (e.g., pnpm build, lint) defined in external configuration files. This mechanism represents a significant security surface where a collaborator or an external contributor (via a Pull Request) could modify the configuration files to execute unauthorized code on the system running the agent.

verification