The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external repository content and skill definitions provided by users. This creates an attack surface where a malicious repository could contain instructions intended to influence the agent's behavior during the auditing process.
Ingestion points: The tools/check-skill-repo.sh script clones external repositories for inspection, and the SKILL.md instructions guide the agent to read and search external skill data.
Boundary markers: The skill uses a structured methodology (Luban's five steps) to maintain focus, although it lacks explicit data delimiters when processing untrusted text.
Capability inventory: The skill possesses network access (curl, gh api, git clone) and file system capabilities (mkdir, cat into files in scaffold-skill.sh, grep/find in check-skill-repo.sh).
Sanitization: The tools/check-skill-repo.sh script implements regex-based validation (is_github_target) to ensure repository URLs follow expected formats before attempting to clone them.
[COMMAND_EXECUTION]: The skill utilizes local shell scripts to automate its auditing workflow.
Evidence: tools/check-skill-repo.sh executes git clone, find, and grep. tools/scaffold-skill.sh uses mkdir and cat to generate project skeletons. These commands are restricted to the local environment and user-specified targets, following standard developer tool patterns.

luban