The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to execute shell commands (e.g., tests, linters, builds) and read their 'FULL output' to verify claims. This creates a surface where an attacker, by controlling the code or environment being tested, could generate malicious command output designed to inject instructions into the agent's context.
Ingestion points: Step 3 (READ) of the Gate Function in references/gate-function.md specifies reading the complete output of verification commands.
Boundary markers: The skill provides procedural boundaries (e.g., checking exit codes and specific counts), but does not instruct the agent on how to sanitize or delimit the external output to prevent prompt injection.
Capability inventory: The workflow assumes the agent has access to shell execution tools to run commands like pytest, make, and ruff.
Sanitization: No explicit sanitization or escaping of the command output is described before the agent processes the data.
[METADATA_POISONING]: The skill exhibits an inconsistency in metadata authorship. SKILL.md attributes the content to Jesse Vincent and references an external repository (obra/superpowers-skills), while metadata.json attributes it to bobmatnyc and references a different repository (bobmatnyc/claude-mpm-skills). While potentially a legitimate fork, such discrepancies can be used to mask the true origin of instructions.

verification-before-completion