The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted repository content, including package manifests and configuration files, which could potentially contain malicious instructions designed to influence the agent's behavior during toolchain alignment.
Ingestion points: Repository manifest files (e.g., package.json), lockfiles, and tool-specific configuration files such as ESLint or Oxlint configs as described in SKILL.md Step 2.
Boundary markers: The instructions do not define specific delimiters or instructions to separate repository-provided content from the agent's core instructions, increasing the risk of instruction following from data.
Capability inventory: The skill is authorized to execute local shell commands for linting, formatting, type-checking, and testing as detailed in SKILL.md Steps 3 and 7.
Sanitization: No explicit sanitization or filtering of the ingested repository content is described before it is used to inform agent actions or command construction.
[COMMAND_EXECUTION]: The skill is instructed to identify and execute various commands found within the repository's configuration or scripts to perform its primary function of alignment and validation.
Evidence: SKILL.md (Steps 3, 6, and 7) instructs the agent to run "repository-approved read-only commands" and "required formatter, lint, type, test, and aggregate validation gates" derived from the project structure.

linting-alignment