The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in references/stock.md direct the agent to construct and execute a git clone command using variables such as <url> and <library-root>. This pattern creates a command injection surface if the agent or platform does not properly sanitize these inputs before execution in a shell environment.
[INDIRECT_PROMPT_INJECTION]: The 'Consult' and 'Research' workflows ingest data from external repositories, which is then processed to answer questions or generate reports. This data is untrusted and could contain instructions designed to manipulate the agent's behavior.
Ingestion points: Content of files read from repositories cloned into <library-root>/sources/ (referenced in references/consult.md and references/research.md).
Boundary markers: None present. The instructions do not specify the use of delimiters or 'ignore' instructions for the ingested code and documentation.
Capability inventory: File system reads, file system writes (for reports), rg (ripgrep) for searching, and git clone for initial ingestion.
Sanitization: The instructions do not define any sanitization, filtering, or validation steps for the content retrieved from external repositories.
[EXTERNAL_DOWNLOADS]: The skill is designed to download code and documentation from external sources (primarily GitHub) using git clone. While this is the core functionality, it represents the primary vector for introducing untrusted data into the local environment.

the-librarian