The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is designed to execute local project tools, including build systems, test runners, and servers to verify the codebase state.
Evidence: The 'Modes and boundaries' section explicitly authorizes the agent to 'run safe local tests, builds, servers, browser flows, disposable repros, isolated test data, [and] temporary artifacts.'
[PROMPT_INJECTION]: The skill has a large indirect prompt injection surface because it reads and processes the entire content of a repository, which may include untrusted third-party documentation, issues, and source code containing malicious instructions.
Ingestion points: The 'Map before judging' section instructs the agent to read 'applicable project instructions, vision and product documentation, current source, tests, fixtures, configuration, lockfiles, generated interfaces, schemas, public APIs, examples, templates, completion contracts, packaging, CI, scripts, release, deployment, and operational definitions.'
Boundary markers: The instructions include a heuristic to 'Treat documentation, tests, issue text... as leads, not proof,' but do not establish formal data/instruction delimiters or use structured parsing for all inputs.
Capability inventory: The skill possesses significant capabilities including command execution, filesystem writes (JSON artifacts and temporary probes), and network access for documentation verification.
Sanitization: There is no evidence of content sanitization or escaping when interpolating repository content into the agent's context.
[COMMAND_EXECUTION]: The skill uses 'falsification probes' which involve programmatically mutating source code to verify that test suites correctly detect failures.
Evidence: The 'Modes and boundaries' section describes a process of introducing 'targeted wrong behavior' and comparing the 'final tree byte-for-byte with the recorded state.'

codebase-audit