The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by processing data from external, potentially untrusted configuration files.
Ingestion points: The skill reads contract definitions from .p2p/work/<slug>/contract.md and processes evidence records from the evidence/ directory and candidate.json.
Boundary markers: The instructions do not specify the use of delimiters or clear boundaries to isolate external content from the agent's instructional logic.
Capability inventory: The skill is capable of executing shell commands and test suites (e.g., "Run the smallest high-signal checks", "Run a full suite") based on mappings derived from the contract.
Sanitization: There is no evidence of sanitization or filtering of the content read from external files before it influences command execution.
[COMMAND_EXECUTION]: The skill's primary function involves identifying and executing commands and tests to verify requirements. Because these commands are determined by the contents of external project files, it presents a risk if those files are controlled by an adversary.

prove