The Agent Skills Directory

[COMMAND_EXECUTION]: The validator script (scripts/validate_structure.py) utilizes subprocess.run to execute external shell commands. Specifically, it invokes bash -n and node --check to validate the syntax of code blocks extracted from the generated whitepaper. While these flags are intended for syntax validation and do not execute the provided code, the practice of invoking system interpreters on content derived from untrusted source files constitutes an attack surface.
[INDIRECT_PROMPT_INJECTION]: The skill's core workflow involves reading and interpreting content from potentially untrusted files within a repository, such as documentation (README.md, ARCHITECTURE.md), specifications (openspec/specs/), and the source code itself. These sources could contain malicious instructions designed to manipulate the agent's output or behavior during the whitepaper generation or validation phases.
Ingestion points: As defined in SKILL.md (Steps 2 and 3), the agent ingests data from docs/, documentation/, living docs at the root, OpenSpec capability files, and the repository's source directories.
Boundary markers: The skill relies on structural templates (references/whitepaper-template.md) and a policy that 'code is the final authority,' but it does not specify explicit delimiters or instruction-ignore blocks when processing ingested data.
Capability inventory: The agent has the capability to write to the file system (WHITEPAPER.md) and execute a local Python script (scripts/validate_structure.py) which spawns subprocesses for syntax validation.
Sanitization: There is no evidence of explicit sanitization or filtering of ingested text to prevent prompt injection or command injection patterns prior to processing.

whitepaper-writer