The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to 'Interview the repo' by reading codebase documentation, including READMEs, package scripts, and Makefiles. This creates a surface where malicious instructions embedded in the project files could influence the generation of the verification skill.
Ingestion points: Project files, package scripts, Makefiles, and README files analyzed in the 'Interview the repo' section of SKILL.md.
Boundary markers: No explicit delimiters or instructions are provided to the agent to treat repo-provided strings as untrusted data.
Capability inventory: The agent is granted the capability to write files (creating the new skill), execute shell commands (to launch and test the app), and use browser/device automation tools.
Sanitization: The instructions do not specify any validation or sanitization of the commands extracted from the repository.
[COMMAND_EXECUTION]: The skill instructs the agent to discover and run shell commands directly from the project's own documentation (e.g., 'documented dev command', 'package scripts', 'Makefile'). It also mandates running the generated skill's instructions end-to-end to verify the deliverable.
[DYNAMIC_EXECUTION]: The skill's core function is to generate a new agent skill (including a SKILL.md file and scripts) at runtime and subsequently execute those generated components. While this occurs within the project's local environment, it represents the creation and execution of code generated from untrusted or unverified source data.

create-verification-skill