The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external Markdown files (skills, rules, or agent definitions) to generate compliance specifications and test scenarios.
Ingestion points: The skill reads content from user-provided Markdown files in scripts/spec_generator.py and scripts/scenario_generator.py to facilitate automated testing.
Capability inventory: The skill has the capability to execute shell commands via subprocess.run and invoke the claude CLI.
Boundary markers: Prompts in prompts/spec_generator.md and prompts/scenario_generator.md use triple-dash (---) delimiters to encapsulate the ingested skill content.
Sanitization: No explicit validation or filtering is performed on the content of ingested files before they are interpolated into the prompt for spec and scenario generation.
[DYNAMIC_EXECUTION]: The skill executes shell commands that are dynamically generated by an LLM at runtime.
Evidence: In scripts/runner.py, the _setup_sandbox function iterates through scenario.setup_commands (which are produced by an LLM in scripts/scenario_generator.py) and executes them using subprocess.run.
Risk: While the skill attempts to sanitize the sandbox directory path, the commands themselves are not validated. Maliciously crafted input files could influence the LLM to generate dangerous commands that would be executed on the host system.
[COMMAND_EXECUTION]: The skill makes extensive use of shell command execution to manage its testing environment and run agent simulations.
Evidence: Multiple scripts (runner.py, classifier.py, scenario_generator.py, spec_generator.py) use subprocess.run to call the claude CLI and various git/filesystem utilities.
Context: This behavior is central to the skill's purpose of creating sandboxed environments and capturing tool call traces for analysis.

skill-comply