The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted repository content (code, documentation, and logic) to extract falsifiable claims. This creates an attack surface where malicious content in the audited codebase could attempt to influence the agent's behavior or findings.
Ingestion points: SKILL.md describes Stage 1 and 2 where the agent surveys repository languages, manifests, READMEs, and code to extract claims.
Capability inventory: The skill utilizes network access via assets/fetch_sources.py and WebFetch, subagent creation for verification and refutation, and local script execution for linting (assets/report_lint.py).
Sanitization: Risks are mitigated by a multi-stage verification process including schema validation in assets/report_lint.py, a mandatory grounding invariant requiring verified sources for violations, and an adversarial refutation pass detailed in references/verdict-rubric.md.
[PRIVILEGE_ESCALATION]: The skill instructions in SKILL.md include a fallback mechanism to discover the absolute path of its helper scripts by scanning specific directories in the user's home folder, which represents environment discovery.
Evidence: SKILL.md suggests using find ~/.claude ~/.config ~/.agents -path '*base-in-reality*/assets/fetch_sources.py' 2>/dev/null | head -1 to locate the fetch_sources.py script if the base directory is not automatically provided by the harness.
[DATA_EXFILTRATION]: The skill extracts claims about the repository's internal logic and architecture and sends them as search queries to external scholarly and academic services.
Target services: Queries are sent to well-known scholarly APIs including arXiv (export.arxiv.org), PubMed (eutils.ncbi.nlm.nih.gov), CrossRef (api.crossref.org), OpenAlex (api.openalex.org), and Semantic Scholar (api.semanticscholar.org).
Evidence: assets/fetch_sources.py handles the construction and execution of these queries using the Python standard library's urllib.request.urlopen.

base-in-reality