The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses git clone to download external source code from provided URLs to the local /tmp directory for analysis.
[COMMAND_EXECUTION]: The skill executes shell commands to clone repositories and suggests running arbitrary code to verify technical claims.
[DYNAMIC_EXECUTION]: The instructions 'Test when possible: run code' involve the execution of potentially untrusted scripts or binaries found within downloaded repositories.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from external sources, presenting a vulnerability to instructions hidden in web pages or source code.
Ingestion points: WebSearch, WebFetch, and git clone are used to bring external data into the agent context (SKILL.md).
Boundary markers: The skill lacks instructions for using delimiters or warnings to ignore embedded directives in the fetched data.
Capability inventory: The skill has file system access (cloning to /tmp) and the ability to execute code (SKILL.md).
Sanitization: There are no documented steps for sanitizing or validating external content before it is processed or executed.

technical-research