The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process extensive data from potentially untrusted repositories, creating a surface for indirect prompt injection via project metadata or code.
Ingestion points: The skill reads repository manifests (package.json, pyproject.toml, etc.), lockfiles, scripts, entrypoints, and existing documentation as established in SKILL.md and references/repo-inspection.md.
Boundary markers: No specific delimiters or markers are defined to isolate untrusted repository content from the agent's instructional context.
Capability inventory: The skill allows the agent to execute shell commands ("execute the primary happy path locally") and modify the repository's README.md file based on its findings.
Sanitization: The skill relies on high-level safety instructions (e.g., "Do not run commands that... expose secrets") rather than technical sanitization or filtering of the ingested content.
[COMMAND_EXECUTION]: The skill explicitly directs the agent to run local commands discovered during the repository inspection process to verify the documentation.
Evidence: SKILL.md (Step 6) and references/repo-inspection.md instruct the agent to identify the project's setup mechanism and "run the primary local path" to ensure copy-pasteability for users, which could lead to the execution of malicious scripts if the repository is compromised.

readme-first