The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the CLAUDE.md file located in the repository root.
Ingestion points: The script reads the content of CLAUDE.md (via grep and sed) to extract setup commands.
Boundary markers: No delimiters or warnings are used to prevent the agent from obeying instructions embedded within the processed file.
Capability inventory: The skill is designed to return extracted strings (INSTALL_CMD, POSTINSTALL_CMD) which are intended to be executed directly in a shell by the caller.
Sanitization: There is no validation, filtering, or escaping of the extracted commands. Any arbitrary command placed inside backticks in the ### Setup section of CLAUDE.md will be extracted and potentially executed.
[COMMAND_EXECUTION]: The skill facilitates the execution of arbitrary shell commands sourced from documentation. The 'Integration Pattern' section demonstrates that extracted values are intended for direct shell execution (e.g., $INSTALL_CMD). A malicious project could include harmful commands (e.g., data exfiltration or file deletion) in its CLAUDE.md that would be triggered during the automated setup process.

validating-setup-commands