The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the local repository to guide its behavior. Specifically:
Ingestion points: It reads Persona: and Style: lines from CLAUDE.md or AGENTS.md to configure the agent's voice and behavior. It also parses commit messages, PR descriptions, and issue metadata to determine the intent behind code changes.
Boundary markers: The skill looks for specific headers (e.g., ## Agent skills) to locate instructions, but does not provide robust sanitization or delimiters to prevent embedded malicious instructions within those sections from overriding agent constraints.
Capability inventory: The skill possesses the ability to execute shell commands (git, gh, bash), run project-defined build and test scripts (npm, cargo, pytest), and write modifications to the file system.
Sanitization: There is no evidence of filtering or escaping logic applied to the content read from the repository files before it is used to influence the agent's logic.
[COMMAND_EXECUTION]: The skill's references/checks.md module is designed to discover and execute shell commands found within the project's environment.
It identifies and runs scripts from package.json, Makefile, justfile, and GitHub Workflow files.
It explicitly executes arbitrary commands defined in a Validation: line within CLAUDE.md or AGENTS.md if present.
[DYNAMIC_EXECUTION]: The skill uses dynamic logic to determine which executable tools to invoke at runtime.
It chooses between various language-specific test runners (cargo test, go test, pytest) based on the detected project type.
It spawns subagents (weaver) with instructions derived from local reference files, which are then applied to the conflicted code paths.

mend