The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by instructing the agent to ingest and follow instructions from potentially untrusted repository files.
Ingestion points: The workflow in SKILL.md (Step 1) explicitly directs the agent to read AGENTS.md, README, and other repository documentation to build context.
Boundary markers: No boundary markers or 'ignore' instructions are provided to the agent to distinguish between the skill's core instructions and data processed from the repository.
Capability inventory: The skill possesses the capability to execute shell commands found in repository files via its verification workflow.
Sanitization: There is no evidence of sanitization, validation, or filtering of the content read from the repository before it influences agent behavior or command discovery.
[COMMAND_EXECUTION]: The skill is designed to discover and execute shell commands defined in repository manifest files.
Evidence: Section 2 ('Discover verification commands') and Section 3 ('Run required verification') in SKILL.md instruct the agent to identify and run scripts found in package.json, Makefile, CI config, and other task files.
Risk: An attacker could place malicious commands in these files (e.g., inside a script or task definition). When the agent runs these 'verification' checks, it would execute the attacker's code in the user's environment.

review-implementation