The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill follows a pattern of analyzing a codebase, generating new instructions and shell scripts, and then immediately executing those generated components to verify their functionality (Section 4, "Prove the generated skill before handing it over"). This runtime generation and execution of code based on external inputs is a significant attack surface.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to "interview" a repository by reading its codebase, README files, and build configurations. This untrusted data is then used to construct the logic for the generated verification skill. Maliciously crafted documentation or metadata in a project could lead to the generation of harmful commands that are subsequently executed by the agent.
Ingestion points: Project repository files including README, package scripts, Makefiles, and source code (SKILL.md Section 1).
Boundary markers: None are specified for the generated instructions to separate untrusted repo data from the execution logic.
Capability inventory: The agent performs file system writes to create the new skill, executes shell commands to build and launch apps, and performs network/browser operations to drive features.
Sanitization: The instructions do not include steps to sanitize or validate the inputs derived from the repository before they are incorporated into shell commands or prompt templates.
[COMMAND_EXECUTION]: The skill instructions explicitly direct the agent to execute shell commands found within the repository (e.g., dev commands, package scripts, Makefiles) and to run its own generated output. This includes complex operations like starting servers, running harnesses, and capturing terminal artifacts.

create-verification-skill