The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the repository's manifest files and a documentation file to determine installation and testing commands. A malicious repository could influence the agent's actions by poisoning these files.
Ingestion points: Manifest files (package.json, Cargo.toml, requirements.txt, etc.) and docs/agents/project.md in the user's workspace.
Capability inventory: Shell command execution via git, package managers (npm, pip, cargo, etc.), and test runners.
Boundary markers: None present; the agent is instructed to use the commands found in these files directly.
Sanitization: None present.
[COMMAND_EXECUTION]: The skill executes several shell commands to manage git worktrees and install project dependencies. It also executes a test command retrieved dynamically from the repository's documentation.
Evidence: Commands include git worktree add, pnpm install, cargo build, and the dynamic runner command specified in docs/agents/project.md.
[EXTERNAL_DOWNLOADS]: The skill triggers downloads of external software packages from official registries via standard package managers during the dependency installation step.
Evidence: Step 2 triggers pnpm-lock.yaml → pnpm, Cargo.toml → cargo build, requirements.txt → pip, etc.

isolate-workspace