The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from a variety of untrusted sources, including source code files, PDF documents, and external websites. This content is analyzed to propose proof strategies or generate search scripts. While the ultimate proof is verified by the Lean kernel, the intermediate interpretation steps are susceptible to influence from adversarial content embedded in the ingested math data.
Ingestion points: Processes .lean files, PDFs via the Read tool, and web content via WebFetch (documented in references/learn-pathways.md and references/disprove-engine.md).
Boundary markers: Uses transactional and boundary markers for generated artifacts, but lacks explicit markers for external data being processed in context.
Capability inventory: The skill has extensive permissions including file modifications (Edit), shell execution (Bash), and project compilation (lake build).
Sanitization: No explicit sanitization of input text is performed before interpolation into internal prompts.
[DYNAMIC_EXECUTION]: As part of its counterexample search functionality, the skill generates executable scripts (Python, Bash, SMT-Lib) at runtime based on model reasoning. These scripts are then executed via the Bash tool. The skill includes a security control requiring a confirmation prompt that shows the script to the user for review before execution.
[EXTERNAL_DOWNLOADS]: The skill references documentation and installation resources hosted on the author's GitHub repository (github.com/cameronfreer/lean4-skills). These references are consistent with standard plugin maintenance and originate from the trusted author context.

lean4