The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it reads and processes untrusted data from the local project environment (source code, configuration files, and manifests) to generate documentation. If an attacker places malicious instructions within the project files, they could potentially influence the agent's behavior during the README generation process.
Ingestion points: The skill reads from various project directories such as app/, src/, server/, api/, and config/ via subagents.
Boundary markers: The subagents are instructed to return findings in structured tables, which provides a level of structural isolation but does not fully prevent instruction override.
Capability inventory: The agent can read local files and is instructed to execute shell commands for document verification.
Sanitization: There is no explicit sanitization or filtering logic mentioned for the content ingested from the project files.
[REMOTE_CODE_EXECUTION]: The verification workflow includes instructions to run npx -y commands, which download and execute packages (such as markdownlint-cli, markdown-link-check, and @mermaid-js/mermaid-cli) from the public npm registry.
[COMMAND_EXECUTION]: The skill provides explicit shell commands for the agent to run during the verification phase to perform markdown linting and relative link checks.

writing-project-readme