The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions (Step 1) direct the agent to discover and run the repository's own development commands, such as 'package scripts, Makefile, README quickstart'. It also instructs the agent to build binaries or install dependencies to ensure the app starts.
[INDIRECT_PROMPT_INJECTION]: The skill has a high vulnerability surface for indirect injection because it reads untrusted data from the local repository (READMEs, configuration files, and source code) to decide which commands to execute. An attacker could poison these files to achieve command execution during the 'interview' or 'prove' phases.
Ingestion points: Project README files, package.json, Makefile, and other root configuration files (Step 1).
Boundary markers: Absent. The instructions do not warn the agent to ignore embedded instructions in the repository files.
Capability inventory: Full command-line access (npm, make, bash), file system write access (to create the skill and artifacts), and network access (implied by build tools).
Sanitization: Absent. Content from the repo is used directly to generate the generated skill's instructions.
[DYNAMIC_EXECUTION]: The skill implements a dynamic code generation loop where it writes a new agent skill (SKILL.md and feature maps) based on project data and then immediately executes those generated instructions to 'prove' the deliverable (Step 4).
[DATA_EXFILTRATION]: The discovery process (Step 1) explicitly searches for sensitive configuration details, including environment variables and authentication mechanisms ('Note ports, env vars, seed data, auth'). While intended for local environment setup, this identifies sensitive file paths for the agent to access.

create-verification-skill