The Agent Skills Directory

[DYNAMIC_EXECUTION]: The bundled scripts/digest.cs tool implements a validation mode (--validate-results) that parses C# code blocks from agent-authored Markdown files and executes them using dotnet test. This mechanism allows for the execution of arbitrary code that the agent generates during the digest creation process.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from remote git repositories provided via --repo-url or --external-repo-url.
Ingestion points: Untrusted source code, tests, and documentation are cloned and packed into XML evidence files (e.g., source.xml, readmes.xml) located in the evidence/ workspace folder.
Boundary markers: Absent; the instructions do not define strict delimiters or 'ignore' instructions to prevent the agent from following malicious prompts embedded within the repository files.
Capability inventory: The scripts/digest.cs script has the capability to execute shell commands (git clone, dotnet test) and perform network requests via HttpClient.
Sanitization: Absent; C# snippets extracted from the agent's output are written to temporary files and executed without any sanitization or sandboxing of the code content.
[COMMAND_EXECUTION]: The skill utilizes the bundled C# script to invoke external CLI tools including git for shallow cloning and dotnet for project creation and execution. These operations are performed based on parameters derived from user input and repository metadata.
[REMOTE_CODE_EXECUTION]: A malicious repository could exploit the indirect prompt injection surface to trick the agent into writing harmful C# code into a result file. If the validation command is subsequently run, that code would execute on the user's system with the agent's privileges, completing an RCE attack chain.

git-repo-digest