The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface by ingesting and acting upon instructions found in project-level contract files.
Ingestion points: The skill reads contract definitions from contracts/ (e.g., openapi.yaml, README.md) and uses them to populate criteria.json.
Capability inventory: The evaluator subagent is provided with Bash, Grep, and Read tools. It is specifically instructed to execute the commands found in the how_to_verify field of the criteria.
Boundary markers: While the dispatch prompt uses role-play instructions to constrain the subagent, there are no structural delimiters to prevent the subagent from following malicious instructions embedded within the contract data.
Sanitization: There is no evidence of command sanitization or verification of the how_to_verify strings before they are executed in the shell.

contract-conformance-loop