The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest untrusted data from a repository's codebase and documentation to generate executable verification steps.
Ingestion points: SKILL.md instructions for Step 1 ("Interview the repo, not the user") and Step 3 ("Seed the feature map") involve reading and interpreting arbitrary project files.
Boundary markers: There are no instructions to use delimiters or to ignore embedded instructions found within the project's source code or documentation.
Capability inventory: The skill utilizes file writing, symlink creation, and shell command execution.
Sanitization: The skill lacks steps to sanitize or validate the information extracted from the repository before it is incorporated into generated scripts and commands.
[COMMAND_EXECUTION]: In Step 4 ("Prove the generated skill before handing it over"), the skill instructs the agent to execute the generated verification steps "end to end." These steps include "Launch" and "Doctor" commands which are derived directly from the potentially untrusted project files, creating a direct path for command injection.
[DYNAMIC_EXECUTION]: The skill dynamically generates a project-local skill (including SKILL.md and helper scripts) and immediately executes its instructions. Generating and running code based on external, unvalidated input is a significant attack surface.

create-verification-skill