The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill operates by reading instructions and verification commands from step-<n>.md files, which serves as a potential vector for indirect prompt injection if the files are improperly authored or influenced by malicious inputs.
Ingestion points: The agent reads the content of step-<n>.md and referenced files in the 'Changes Required' section to determine its actions.
Boundary markers: No explicit boundary markers or instructions are defined to separate plan data from executable instructions, increasing the risk that the agent may follow unintended commands embedded in the data.
Capability inventory: The skill possesses capabilities for file system modification (Edit, Write) and arbitrary shell command execution during the verification phase.
Sanitization: There is no evidence of sanitization or validation of the commands extracted from the markdown files before they are executed in the shell.
[COMMAND_EXECUTION]: In Step 4 (Run Verification), the agent is instructed to execute 'runnable commands' and 'agent-driven scenarios' directly from the step file. Because the skill is designed to run in 'Autopilot' mode and is explicitly forbidden from using AskUserQuestion, it will execute these commands without user review, creating a risk of unauthorized code execution if the input file contains malicious instructions.

step-running