The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is instructed to run 'the repository's relevant local checks, including the commands that commit hooks run'. This results in the execution of arbitrary commands defined in the project's configuration (e.g., .git/hooks, package.json scripts), which are outside the skill's direct control.
[INDIRECT_PROMPT_INJECTION]: The skill identifies an attack surface by reading and following 'repository instructions' found in the workspace.
Ingestion points: SKILL.md instructions to 'Read repository instructions' and 'inspect the worktree'.
Boundary markers: The skill lacks explicit boundary markers or instructions to ignore embedded commands in the processed files.
Capability inventory: Access to git, gh, tea, and package managers allows for file modification, command execution, and network communication.
Sanitization: There is no evidence of sanitization or filtering applied to instructions fetched from the repository files.
[DYNAMIC_EXECUTION]: The skill automatically triggers dependency installation ('install them with the repository's package manager') when needed. This typically involves executing lifecycle scripts (pre-install/post-install) defined in the repository's package manifest, leading to the execution of code found in the target environment.
[EXTERNAL_DOWNLOADS]: The skill performs external downloads during dependency installation from official package registries. While standard for development, this process retrieves external code based on the repository's configuration.

ship-pr