The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from web search results and synthesized research to rewrite sensitive local files such as SKILL.md and CLAUDE.md.
Ingestion points: External content fetched via WebSearch and WebFetch in Phase 2 is stored in findings.md and used for synthesis.
Boundary markers: No specific delimiters or instructions are used to prevent the agent from obeying commands embedded within the retrieved web content.
Capability inventory: The skill can write to the local file system, execute Python scripts, and perform Git operations.
Sanitization: No validation or sanitization is performed on the web content before it is used to generate new prompts and rewrite artifacts.
[PROMPT_INJECTION]: The skill's evaluation loop instructions use strong directives to enforce autonomous behavior and override the agent's default safety or interactive protocols.
Evidence: The references/eval-loop.md file instructs the agent to "Be aspy, do not stop, keep looping" and "DO NOT pause to ask the user," which are attempts to override typical conversational constraints.
[DYNAMIC_EXECUTION]: The skill executes a locally provided Python script as part of its automated evaluation process.
Evidence: The file scripts/score_evals.py is invoked at runtime to score model outputs based on dynamically generated assertions.
[COMMAND_EXECUTION]: The skill uses the Git command-line tool to manage the project workspace and iteration history.
Evidence: Execution of commands such as "git init", "git add", "git commit", and "git rev-parse" to track changes to artifacts.

auto-research