The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions direct the agent to 'Interview the repo' by reading codebase files such as READMEs, package scripts, and Makefiles to determine how to build and drive the application. This creates a surface where malicious instructions embedded in a repository could influence the agent's behavior during the generation or execution phase.
Ingestion points: SKILL.md (Step 1) specifies reading repository content (README, package scripts, Makefile, docs) to identify launch and drive commands.
Boundary markers: Absent. The instructions do not define delimiters for untrusted repo content or warnings to ignore embedded instructions.
Capability inventory: Shell command execution (build, launch, drive, cleanup), browser automation via CDP, and file writing (Step 2 and Step 3).
Sanitization: Absent. The agent is encouraged to 'fix' the checkout based on what it observes in the codebase without explicit sanitization steps.
[COMMAND_EXECUTION]: The skill requires the agent to execute shell commands to 'fix' broken builds and to run the generated verification skill end-to-end. This involves executing arbitrary commands found in the repository's configuration or derived from its structure.
Evidence: SKILL.md (Step 4) requires running 'launch, doctor, drive ONE mapped feature' and Step 1 encourages fixing the checkout if it doesn't build.
[DYNAMIC_EXECUTION]: The skill operates by generating a new agent skill (.agents/skills/verify-<app>/SKILL.md) and helper scripts at runtime, which are then immediately executed by the agent to verify the application.
Evidence: SKILL.md (Step 2 and Step 4) outlines the generation of a project-local skill and its subsequent execution for proof of concept.

create-verification-skill