The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the project's source files to identify feature behavior and document drift. This creates a surface where malicious instructions hidden in code comments, documentation, or metadata within the project being audited could influence the agent's actions during the maintenance cycle.
Ingestion points: The 'Source wave' step (Step 2) involves read-only subagents scanning project source files.
Boundary markers: The instructions do not specify delimiters or explicit warnings to the subagents to ignore embedded instructions within the source code.
Capability inventory: The skill has the capability to write to the verification skill's directory and execute harness scripts and application drivers.
Sanitization: There is no mention of sanitizing or filtering the content read from the source files before it is processed by the agent.
[DYNAMIC_EXECUTION]: The skill executes harness scripts and drives the application under test during the 'Live pass' and 'Triage' phases. Executing dynamically identified scripts or driving an application process based on instructions derived from source code carries a risk of unintended code execution if the environment or scripts are compromised.
Evidence: Step 4 (Live pass) and Step 5 (Triage) involve driving the app following the target skill's launch model and executing harness scripts (e.g., '.agents/skills/verify-*/harness scripts').
[COMMAND_EXECUTION]: The skill is designed to interact with the system shell to drive various application types (servers, UIs, CLIs) and run verification harnesses, which involves executing multiple commands based on the configuration of the target skill being maintained.

maintain-verification-skill