The Agent Skills Directory

[COMMAND_EXECUTION]: The script tools/verify.py executes arbitrary shell commands defined in the skill's configuration (e.g., oracle_cmd, target_cmd, test_cmd). While it uses shlex.split to mitigate shell injection, it still permits the execution of any command string provided in the loop.run.yaml file.
[PROMPT_INJECTION]: The skill processes untrusted failure data to guide the agent's code-writing behavior, creating a risk of indirect prompt injection.
Ingestion points: tools/ingest.py ingests data from external sources including failures.jsonl (red-team output), JUnit XML reports, and test ID lists.
Boundary markers: The skill instructions do not specify any delimiters or warnings to ignore instructions that might be embedded within the ingested failure descriptions or test names.
Capability inventory: The skill has access to subprocess.run for command execution, file system access for patching target_files, and Git/GitHub CLI for creating pull requests.
Sanitization: External commands are processed with shlex.split, but there is no validation or filtering of the failure payloads before they are used to influence the agent's logic for patching code.

blue-team