The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a workflow that requires the agent to search through local codebases using rg (ripgrep) and process the results. This creates a surface for indirect prompt injection if the files being scanned contain malicious instructions designed to influence the agent's behavior.
Ingestion points: Markdown examples in SKILL.md and references/scenarios.md prompt the agent to use rg to find patterns in code, with the output becoming part of the agent's context.
Boundary markers: Absent; there are no instructions to the agent to treat search output as untrusted data or to use specific delimiters.
Capability inventory: The skill has the capability to execute shell commands, specifically python3 scripts/eval_triggers.py and ./gradlew for running tests, which could be targeted by an injection attack.
Sanitization: Absent; the agent is expected to read and interpret the raw output of the search results.
[COMMAND_EXECUTION]: The skill uses local shell commands as part of its development and evaluation workflow.
Evidence: SKILL.md and references/scenarios.md contain commands for code searching (rg), trigger evaluation (python3 scripts/eval_triggers.py), and test execution (./gradlew :app:testDebugUnitTest). While standard for Android development, these represent executable capabilities within the skill's scope.

android-workmanager-notifications