The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions require the agent to ingest untrusted content from the repository (code and documentation) and perform actions based on that content, such as running generation commands and verifying executable examples.
Ingestion points: The agent reads documentation files (READMEs, tutorials, reference guides) and repository source code (diffs, staged/unstaged changes) as primary inputs.
Boundary markers: The skill lacks explicit instructions to treat the analyzed content as untrusted or to ignore embedded natural language instructions that might attempt to hijack the agent's logic.
Capability inventory: The skill uses the verify-commands tool and instructs the agent to "exercise changed examples against the actual implementation" and "follow the repository's... generation commands," which involves shell execution capabilities.
Sanitization: No specific sanitization or filtering of the ingested documentation content is described beyond a general advisory to act "when safe within the task's authority."
[COMMAND_EXECUTION]: The skill directs the agent to run documentation generation and verification commands found within the target repository. While intended for legitimate build processes, this capability could be exploited if an attacker modifies these commands to perform malicious actions.

documentation-impact