The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to install and execute code from untrusted sources to analyze repository capabilities. Phase 3A (CLI Tool Extraction) directs the agent to run commands such as pip install <pkg>, npx <package> --help, node bin/cli.js --help, cargo run -- --help, and go run . --help against the cloned repository or its associated packages. Phase 5 (Final Validation) instructs the agent to execute tests on the generated skill artifacts using uv run pytest tests/ and npx vitest run, which involves running code derived from the untrusted repository.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from git repositories, creating an attack surface where malicious repository content could influence agent behavior. Ingestion points: Repository scouting scripts (scripts/scout.sh, scripts/scout.ps1) and Phase 1 metadata probes read READMEs, configuration files (package.json, pyproject.toml, Cargo.toml), and directory structures. Boundary markers: The instructions do not define boundary markers or instruct the agent to ignore embedded instructions within the processed repository content. Capability inventory: The skill utilizes git clone, file system writes, and subprocess execution for various package managers and test runners. Sanitization: The scout.sh script uses a rudimentary escape_json function for some fields, but others like EXISTING_CLI_NAMES are interpolated into a JSON response without sanitization, potentially leading to malformed data or injection.
[DYNAMIC_EXECUTION]: The skill generates new shell scripts and test files (scripts/setup.sh, tests/test_cli.py, etc.) at runtime based on the scouted repository content and then executes them to validate the generated skill.

git-to-skill