The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and execute untrusted data in the form of code diffs and PR descriptions during the verification process.
Ingestion points: The skill reads output from git diff, gh pr diff, and user-provided descriptions of changes in SKILL.md.
Boundary markers: There are no explicit instructions to the agent to treat the content of the diff as untrusted or to ignore instructions embedded within the code being verified.
Capability inventory: The agent is authorized to run git commands, filesystem operations, and arbitrary shell commands required to build and run the software under test (e.g., via README or package.json instructions).
Sanitization: No sanitization or filtering of the diff content is performed before the agent executes the code to observe its behavior.
[COMMAND_EXECUTION]: The skill requires the agent to execute shell commands to identify changes (git), set up isolated environments (tmux, mktemp), and perform "cold starts" by following build/run instructions found in the repository's documentation or configuration files.
[DYNAMIC_EXECUTION]: The skill instructs the agent to create new skill files (.claude/skills/verify/SKILL.md) when it successfully identifies a build/launch recipe. This involves generating instructional content at runtime that will be executed/loaded by the agent in future steps.
[PERSISTENCE]: By creating new skill files in the .claude/skills/ directory, the skill establishes a mechanism where generated instructions persist across sessions and are automatically loaded whenever the agent interacts with the repository in the future.

verify