The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary workflow involves reading untrusted project code and documentation ("Interview the repo") to generate new agent instructions and skills. This creates a vulnerability surface where malicious content within the target project could influence the generated skill's behavior.
Ingestion points: Project source code, build scripts, Makefiles, and README files are read during the "Interview" phase (detailed in references/create/create-verification-skill.md).
Boundary markers: The instructions do not specify the use of delimiters or sanitization when interpolating project data into the generated SKILL.md.
Capability inventory: The generated skill is explicitly designed to execute shell commands for application launch, health checks (doctor), and browser/CLI driving.
Sanitization: There is no explicit requirement for the agent to sanitize or escape data extracted from the project checkout before including it in the generated skill.
[DYNAMIC_EXECUTION]: The skill instructions require the agent to execute the instructions it just generated ("Prove the generated skill before handing it over") to confirm they work. This involves runtime execution of code/commands that were not part of the original skill package.
[EXTERNAL_DOWNLOADS]: The SOURCE-MANIFEST.json identifies several instruction files as being patched versions of upstream content from an untrusted repository (https://github.com/backnotprop/pstack). While these are references for the skill's own construction rather than runtime downloads, they link the skill's logic to an unverifiable third-party source.

atlas-verifiers