The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions direct the agent to 'Read the repository instruction hierarchy' (such as AGENTS.md, CLAUDE.md, CONTRIBUTING.md) and 'locate the governing specifications, decisions, plans' before performing the audit. This creates an attack surface where a malicious repository could include hidden instructions in these files to manipulate the agent's report, bypass checks, or trigger unauthorized actions.
Ingestion points: The agent reads file names via scripts/collect-repo-evidence.sh and parses the content of instruction files and specifications within the target repository.
Boundary markers: There are no instructions to use delimiters or warnings to ignore embedded instructions within the processed repository data.
Capability inventory: The agent has the capability to execute shell commands and test suites (e.g., unit tests, integration tests, E2E tests) as part of the 'Execute verification in layers' phase.
Sanitization: The skill lacks requirements to sanitize or validate the content of the repository instructions before the agent acts upon them.
[COMMAND_EXECUTION]: The skill requires the agent to execute 'project-authoritative commands' to verify technical requirements. While this is the intended purpose of the skill, it involves running arbitrary code (tests, build scripts, migrations) defined within the repository being audited, which could be malicious.
Evidence: The skill explicitly commands the agent to run static integrity checks, unit tests, integration tests with real dependencies, and end-to-end tests using commands found in the repository.

write-technical-acceptance-report