The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data including git diffs, PR descriptions, commits, and external library source code. This creates a surface for indirect prompt injection where malicious instructions hidden in code comments or documentation could influence the agent's behavior.
Ingestion points: The agent reads diffs, PR content, commit history, and library source files (SKILL.md, Steps 1 and 3).
Boundary markers: There are no explicit instructions to use delimiters or to ignore embedded instructions within the ingested code or metadata.
Capability inventory: The skill allows the agent to read files and execute shell commands or generated scripts (SKILL.md, Step 5).
Sanitization: No sanitization or filtering of external content is mentioned.
[DYNAMIC_EXECUTION]: The skill's core workflow involves the agent writing and executing scripts or tests at runtime to prove the safety of a code change.
Evidence: Instructions in SKILL.md state: "Step 4 is usually one small script that imports the same library the app ships and calls the exact function you're worried about" and "Write a script or test that runs the real code, run it, and paste what happened."
[COMMAND_EXECUTION]: The skill explicitly directs the agent to execute shell commands or scripts to verify findings.
Evidence: "Find the one or two facts the whole thing depends on and prove them by running code." and "You ran it. A script or test that calls the real code and fails loud if you're wrong."

blast-radius