The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill functions by ingesting untrusted data from the repository being analyzed to generate and then execute verification steps, creating a potential vector for indirect prompt injection.
Ingestion points: In SKILL.md (sections 1 and 3), the agent is instructed to "Interview the repo" by reading the codebase, documentation, routes, and command definitions to determine how the app starts and how it is driven.
Boundary markers: There are no explicit instructions or boundary markers defined to prevent the agent from following malicious instructions found within the repo's dev scripts or documentation.
Capability inventory: The skill possesses high capabilities, including writing files to the local file system (.claude/skills/verify/) and executing arbitrary shell commands as part of the verification proof phase.
Sanitization: No sanitization or validation of the extracted commands is performed; the instructions specifically tell the agent to "Prefer the repo's own documented dev command."
[COMMAND_EXECUTION]: The skill identifies and executes complex shell commands to verify application behavior, which is a core part of its autonomous workflow.
Evidence: SKILL.md section 2 ("Launch: the exact command that starts the app") and section 4 ("Run its own instructions end to end once") require the agent to execute shell commands that it has previously extracted or generated.
[DYNAMIC_EXECUTION]: The skill generates new executable content (a local verification skill) and immediately executes it to prove its functionality.
Evidence: In SKILL.md (section 2 and 4), the agent writes a new SKILL.md file and helper scripts based on the repo's content and then executes the "Launch," "Doctor," and "Drive" instructions end-to-end.

create-verification-skill