The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to analyze the repository and "build the binary (or install deps)" or "fix that first" if the project doesn't start correctly. This directs the agent to execute arbitrary build and setup commands defined by the repository's configuration files (e.g., Makefiles or package scripts).
[DYNAMIC_EXECUTION]: Section 4 ("Prove the generated skill before handing it over") explicitly commands the agent to execute the launch, doctor, and drive instructions it has just generated. This results in the runtime execution of commands that were dynamically formulated based on untrusted repository data.
[INDIRECT_PROMPT_INJECTION]: The skill is inherently vulnerable to indirect prompt injection as it ingests untrusted data from the codebase to determine its operational steps.
Ingestion points: All files within the analyzed repository, including READMEs, scripts, and configuration files (SKILL.md, Section 1).
Boundary markers: Absent; there are no instructions to isolate or treat repository content as untrusted.
Capability inventory: The agent has access to shell commands via bash, network requests via curl, and browser automation tools via eval (SKILL.md, Section 1).
Sanitization: Absent; no sanitization or validation of the repository content is performed before it is used to generate executable instructions.

create-verification-skill