The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill generates several shell scripts including _env.sh, _preflight.sh, _assert.sh, and per-endpoint scripts at runtime. These scripts are then executed using bash to perform verification tasks. This dynamic code generation and execution cycle is a core functionality but introduces significant security risk if inputs are not properly sanitized.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple external sources to construct verification payloads and execution parameters, creating a vulnerability surface.
Ingestion points: User-provided payloads, live database rows (MySQL/Postgres/MariaDB), and external metadata files (explore.md, work.md) in SKILL.md and payload-sourcing.md.
Boundary markers: Implements a mandatory Phase 0 Verification Plan Checkpoint for user approval and restricts all file operations to the .backend/ directory.
Capability inventory: Capability to execute shell commands via curl, write files to the local ticket directory, and perform read-only database queries as described in curl-harness.md and SKILL.md.
Sanitization: Extensive PII redaction rules are defined in payload-sourcing.md, replacing sensitive fields with placeholders before they are saved to fixtures or logs.
[COMMAND_EXECUTION]: The skill invokes various system binaries including curl, jq, grep, sed, and awk, and modifies file permissions via chmod +x to execute its generated harnesses.
[DATA_EXFILTRATION]: The skill is designed to sample data from live databases for payload sourcing. While it enforces read-only access, LIMIT clauses, and PII redaction, it inherently involves handling sensitive information. The skill attempts to mitigate this risk by prohibiting production access and requiring explicit user authorization for non-local environments.

verify