The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze content from external, untrusted Git repositories, which creates a surface for indirect prompt injection attacks.
Ingestion points: The workflow involves cloning repositories from user-supplied URLs and reading various files, such as README.md and configuration files (documented in SKILL.md).
Capability inventory: The agent uses shell commands (git, mkdir, rm) and internal file-reading tools to process the repo content.
Boundary markers: The instructions do not specify any delimiters or safety prompts to prevent the agent from following instructions that might be embedded within the external repository's files.
Sanitization: There is no evidence of sanitization or filtering of the repository content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill workflow relies on executing shell commands to manage the repository lifecycle on the host system.
Evidence: The skill uses mkdir -p to create workspaces, git clone --depth 1 to fetch data, and rm -rf to clean up the temporary directory. These commands are necessary for the skill's primary purpose but involve direct interaction with the system shell using user-influenced parameters like repository URLs and names.

public-repo-explorer