The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the repository and conversation context, creating a surface for potential injection attacks.
Ingestion points: The instructions in SKILL.md direct the agent to "Explore the repo" and synthesize "current conversation context" into a specification.
Boundary markers: No specific delimiters or instructions are provided to the agent to disregard potential commands or malicious text embedded within the repository files being analyzed.
Capability inventory: The skill has the capability to read repository contents and perform network operations via tools to publish to an issue tracker.
Sanitization: There is no mention of content sanitization or validation for the data ingested from the codebase.
[DATA_EXFILTRATION]: The skill's primary function involves transmitting data synthesized from the codebase to an external destination.
Evidence: The instructions in SKILL.md require the agent to "publish it to the project issue tracker," which involves a network-based transfer of internal project details.
[COMMAND_EXECUTION]: The skill instructs the agent to invoke a specific configuration command.
Evidence: SKILL.md includes the instruction "run /setup-universal-agent-skills if not" to configure the agent's vocabulary and environment.

to-spec