The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the repository being audited, creating a surface where malicious instructions in the target codebase could influence the agent during scoring or remediation.
Ingestion points: The assets/collect_evidence.py script reads configuration files, documentation, and source code (e.g., package.json, .github/workflows/, CLAUDE.md, and .claude/settings.json) from the target repository.
Boundary markers: No specific boundary markers or instructions to ignore embedded prompts are provided to the agent when it analyzes the collected evidence.
Capability inventory: The skill instructions allow the agent to execute the collector script via shell and to write new files (e.g., entrypoints or CI configurations) to the target repository when applying fixes.
Sanitization: The skill lacks sanitization of external repository content before the agent processes it.
[COMMAND_EXECUTION]: The skill relies on shell command execution to perform its audit functions and run its internal test suite.
The SKILL.md instructions require the agent to run the assets/collect_evidence.py script using python3 to gather repository evidence.
The eval/run_eval.py and assets/test_collect_evidence.py files use subprocess.run() to execute the collector script for evaluation and testing purposes.

agent-ready-rails