The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's primary function is to execute shell commands (e.g., node, pnpm, timeout) to test software behaviors and API responses.
[DYNAMIC_EXECUTION]: The instructions direct the agent to generate and run "the smallest throwaway code" (such as .mjs or shell scripts) at runtime to reduce technical risks.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided questions and potentially external data (API outputs, repository content) which could contain malicious instructions.
Ingestion points: User-supplied questions and outputs from commands or external API calls.
Boundary markers: The skill lacks explicit markers or instructions to delimit or ignore embedded instructions within the data it processes.
Capability inventory: Access to shell execution, filesystem operations in temporary directories, and network operations for testing APIs.
Sanitization: No specific sanitization or validation of user-supplied questions or external command output is mentioned.
[DATA_EXFILTRATION]: While the skill forbids reading secrets from .env files, it explicitly allows the use of environment variables for "Sandbox credentials," which provides a potential path for data access and exfiltration if the agent is directed to test untrusted external endpoints.

spike