The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and analyzes content from the repository, including source code files, configuration files (e.g., .eslintrc, .prettierrc), and project manifests. This untrusted data is used to derive styling conventions and could be used to inject instructions to influence the agent's behavior.
Ingestion points: Source files in the repository, neighboring files for convention sampling, and project configuration files analyzed in the workflow steps.
Boundary markers: The instructions do not define explicit delimiters or instructions to ignore embedded prompts when processing the analyzed data.
Capability inventory: The skill has the capability to write to files, execute project-configured formatting/linting tools, and run the project's test suite via the shell.
Sanitization: The scripts/scope.mjs script identifies and filters out generated or vendored files, which reduces the surface area for injection but does not eliminate the risk from malicious project files.
[COMMAND_EXECUTION]: The workflow requires the agent to run external commands defined within the repository's own toolchain (e.g., npm exec, uv run, poetry run, and the project's test scripts). While this is necessary for the skill's purpose, it executes logic defined in the target repository's manifests and scripts, which are untrusted external inputs.

re0-style