The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions direct the agent to clone external git repositories from user-provided URLs into a local directory.
Evidence: In SKILL.md, the "load" workflow step states: "if the repo(s) are already in the work dir ~/.btca/agent/sandbox update them, otherwise clone them."
[COMMAND_EXECUTION]: To fulfill its workflow, the skill requires the agent to execute system commands for git operations (clone, update) and file searching.
Evidence: The workflow steps "work dir setup", "load", and "search" necessitate shell-level interaction with the local filesystem and the git binary.
[INDIRECT_PROMPT_INJECTION]: The skill is inherently vulnerable to indirect prompt injection as its primary purpose is to ingest and search through external, untrusted content (git repositories).
Ingestion points: The content of any git repository cloned from the internet into the ~/.btca/agent/sandbox directory.
Boundary markers: Absent. There are no instructions provided to the agent to treat repo content as data rather than instructions or to use delimiters.
Capability inventory: The agent has the capability to read, write, and list files within the sandbox directory, as well as initiate network requests via git clone.
Sanitization: None. The skill does not prescribe any validation, filtering, or sanitization of the content found within the searched repositories.

btca-local