The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon instructions found within the repository it analyzes, creating a significant attack surface for indirect prompt injection.
Ingestion points: In Section 1, the agent is directed to "Interview the repo" and extract "Run" and "Drive" commands from repository files, including READMEs, Makefiles, and package configurations.
Boundary markers: The instructions lack specific boundary markers or warnings to the agent to treat repository content as untrusted or to ignore instructions embedded in documentation.
Capability inventory: The skill possesses the capability to execute shell commands, launch server processes, and capture system state evidence as detailed in Step 4.
Sanitization: There are no requirements or mechanisms for the agent to sanitize or validate the logic and commands found in the repository before they are generated into a new skill and executed.
[DYNAMIC_EXECUTION]: The skill follows a pattern of runtime script generation followed by immediate execution.
Evidence: Section 2 ("Generate the skill") and Section 4 ("Prove the generated skill") instruct the agent to write a new skill file and then "Run its own instructions end to end once" to prove functionality. This automated execution of generated content based on external inputs is a notable risk.
[COMMAND_EXECUTION]: The skill encourages the agent to identify and execute arbitrary commands found in the local environment's repository configuration.
Evidence: Section 1 instructs the agent to "Prefer the repo's own documented dev command (package scripts, Makefile, README quickstart)" and Section 2 directs the agent to include the "exact command that starts the app" in the generated skill for execution.

create-verification-skill