The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from project files to determine its implementation plan and verification steps.
Ingestion points: The skill reads SPEC.md, FORMAT.md, and §R files to define tasks, invariants, and interface constraints.
Boundary markers: Absent. There are no delimiters or specific instructions to treat content from these files as potentially untrusted or to ignore embedded instructions that might attempt to hijack the agent's flow.
Capability inventory: The skill possesses the capability to edit local source files and execute arbitrary shell commands defined as "verification commands" (e.g., test, build, lint).
Sanitization: Absent. The skill does not validate or sanitize the commands or code changes it derives from the specification files before execution.
[COMMAND_EXECUTION]: The skill executes shell commands defined within the project context to verify task completion.
Evidence: The PLAN and EXECUTE sections instruct the agent to "Name verification command (test, build, lint)" and then "Run verification command" as an oracle. If an attacker controls the SPEC.md file, they could inject malicious shell commands into the verification step.

build