The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill instructions mandate the execution of arbitrary shell commands retrieved from local configuration files within the repository.
Evidence: Step 8 in SKILL.md states: "Run every command the contract and AGENTS.md require before work is reported complete, and read the diff..."
Risk: This behavior allows a repository to specify executable actions that the agent will perform without a predefined whitelist. A malicious project could include harmful commands in these configuration files to gain unauthorized access or exfiltrate data.
[COMMAND_EXECUTION]: The skill is designed to perform shell operations as part of its validation workflow.
Evidence: The 'Validation' step in SKILL.md explicitly calls for running project-defined commands.
Risk: The lack of constraints on what these commands can be, combined with their dynamic source, creates a vector for code execution attacks.
[INDIRECT_PROMPT_INJECTION]: The skill ingests a large volume of untrusted or external data to generate its outputs and determine its execution path.
Ingestion points: The skill reads project lessons, external references, blueprint manifests, and primary documentation sources (identified in SKILL.md Steps 1 and 4).
Boundary markers: While the skill mentions a 'knowledge boundary', it lacks formal prompt delimiters or instructions to ignore potential commands embedded within the source materials it processes.
Capability inventory: The skill has the capability to write and modify files in the repository (SKILL.md Step 7) and execute shell commands (SKILL.md Step 8).
Sanitization: No sanitization or validation of the content ingested from 'primary sources' or 'lessons' is specified before it is processed or used to generate quiz rationales.

quiz-generator