The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's core workflow involves an "Interview" phase where it reads untrusted data from the repository codebase, including README files, package scripts, Makefiles, and documentation. This content is used to determine the "Launch" and "Drive" commands for the generated verification skill.
Ingestion points: SKILL.md Step 1 reads repo codebase, package scripts, and documentation.
Boundary markers: Absent. The instructions do not warn the agent to validate or sanitize the commands found in the repository.
Capability inventory: The skill uses shell execution to "Prove" the generated output.
Sanitization: Absent. The skill explicitly instructs the agent to use the repo's own documented dev commands literal.
[DYNAMIC_EXECUTION]: The skill dynamically generates a new agent skill (SKILL.md) and associated helper scripts based on information extracted from the local repository at runtime. This generated code is not part of the original skill package and is entirely dependent on the analyzed project's state.
[COMMAND_EXECUTION]: In Step 4 ("Prove the generated skill before handing it over"), the agent is instructed to run the newly created instructions "end to end once," which includes executing the "launch," "doctor," and "drive" commands. Because these commands are derived from untrusted repository content, this creates a path for arbitrary command execution if the repository contains malicious metadata or documentation.

create-verification-skill