The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from the local repository (READMEs, scripts, codebase) to determine how to drive the application. If the repository contains malicious instructions disguised as documentation or commands, the agent might incorporate these into the generated skill.
Ingestion points: SKILL.md Step 1 (Interview the repo) reads package scripts, Makefiles, and READMEs to identify launch and drive commands.
Boundary markers: The skill does not implement boundary markers or instructions to ignore potential prompts embedded within the repository data.
Capability inventory: SKILL.md Step 4 (Prove the generated skill) executes the generated instructions, which involves running shell commands for launching the app and exercising features.
Sanitization: No sanitization or validation of the extracted commands, selectors, or data is described before they are executed in the local environment.
[DYNAMIC_EXECUTION]: The skill dynamically generates a new agent skill (SKILL.md) and feature map files at runtime, then executes the instructions contained within that generated output.
[COMMAND_EXECUTION]: The skill identifies and executes arbitrary shell commands found within the project repository (e.g., build scripts, start commands, and CLI tool invocations) as part of the application verification process.

create-verification-skill