The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data by interviewing the project's codebase (routes, commands, menus, docs) to generate verification instructions. A malicious repository could contain content designed to influence the logic of the generated skill.
Ingestion points: Project repository files analyzed during the "Interview the repo" phase in SKILL.md.
Boundary markers: None identified to separate repository content from the generation prompt.
Capability inventory: The generated skill has capabilities to execute shell commands (launch, doctor, drive, cleanup) and interact with browsers or CLIs.
Sanitization: No explicit sanitization of repository content is described before interpolation into the generated SKILL.md.
[DYNAMIC_EXECUTION]: The skill instructs the agent to generate a new skill (.agents/skills/verify-<app>/SKILL.md) and then immediately execute the instructions contained within it.
Evidence: SKILL.md Section 4 ("Prove the generated skill before handing it over") explicitly requires running the generated instructions end-to-end, including launch, drive, and cleanup phases.
[COMMAND_EXECUTION]: The workflow requires the agent to execute various shell commands determined during the repository interview, including application startup commands and test harness interactions.
Evidence: SKILL.md describes the "Launch" and "Drive" sections which involve executing commands like control-notes browser or custom binary builds.

ps-create-verification-skill