The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's primary function is to launch and manage live processes, such as CLI binaries and web servers. It incorporates strong safety measures, including resolving artifact identity to prevent running stale binaries, establishing resource ownership to avoid interfering with unrelated processes, and implementing bounded observation (timeouts and output limits) to prevent resource exhaustion.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests and processes stdout, stderr, and network response data from running applications to verify behavior.
Ingestion points: Application output is captured in SKILL.md (Stage 3: capture stdout/stderr) and evaluated in Stage 5 (behavior probe).
Boundary markers: The instructions recommend recording evidence narrowly but do not mandate specific delimiters or headers to isolate process output from the agent's instructions.
Capability inventory: The skill allows spawning processes, performing network requests via curl, and terminating processes (SIGTERM/SIGKILL).
Sanitization: There are no instructions for sanitizing or escaping the data received from the running processes before it is processed by the agent.
[DYNAMIC_EXECUTION]: The skill executes applications and scripts at runtime based on the app_target input. It manages the risks associated with dynamic execution by enforcing a strict protocol for environment isolation (CWD/env/ports) and requiring verifiable readiness probes rather than relying on assumed process success.

fable-run