The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill identifies a repository source from a local file (.guardrails-source) or relative path, clones it using git clone, and then executes shell scripts from the result. This creates a supply chain vulnerability where a malicious project can redirect the agent to execute code from an attacker-controlled repository.
[COMMAND_EXECUTION]: The skill relies on numerous shell commands for repository initialization, filesystem management, and executing the installed guardrails toolset. This provides the agent with broad capabilities to modify the local environment.
[EXTERNAL_DOWNLOADS]: In addition to cloning the guardrails repository, the skill's test runner is designed to automatically download the bats-core testing framework if it is not already present in the environment.
[INDIRECT_PROMPT_INJECTION]: The skill ingests existing project content from AGENTS.md, CLAUDE.md, and various ledger files to bootstrap the guardrails process. This data ingestion lacks sanitization and creates an attack surface for instructions hidden in project documentation.
Ingestion points: Project root files (AGENTS.md, CLAUDE.md) and documentation directories (docs/requirements/, docs/risk/, etc.).
Boundary markers: None are specified to protect the agent context from embedded instructions in the ingested files.
Capability inventory: File writes, shell command execution, and git operations.
Sanitization: The skill does not validate or sanitize the content of the files it reads before processing them.

ratchet