The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a bundled Python script scripts/metadata.py to collect environment information. The script uses subprocess.run to execute hardcoded git commands (e.g., git remote, git rev-parse, git branch) to identify repository details, commit hashes, and branch names. While the commands are static, this represents a shell execution capability within the skill workflow.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an inherent vulnerability to indirect prompt injection because its core function is to read and synthesize content from arbitrary files within a codebase.
Ingestion points: The agent is instructed to read files mentioned by the user (Step 1) and relevant files identified during discovery (Step 4) using the Read tool.
Boundary markers: The instructions do not specify the use of delimiters or warnings to ignore instructions found within the analyzed files, increasing the risk that the agent may follow malicious directives embedded in comments or documentation.
Capability inventory: The skill has the ability to execute shell commands via the metadata script and write new files to the filesystem in Step 7 (docs/agents/research/).
Sanitization: There is no evidence of sanitization or filtering applied to the content read from the codebase before it is processed by the agent.

rpi-research