The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill analyzes external repository files (e.g., package.json, pyproject.toml, README.md) to generate context, which introduces a potential attack surface if those files contain malicious instructions.
Ingestion points: The skill scans numerous project files during the 'Analyze the Repository' phase in SKILL.md.
Boundary markers: The skill contains a 'Security: Data Boundaries' section explicitly instructing the agent to treat all repository content as untrusted data and to ignore free-text instructions within those files.
Capability inventory: The skill possesses file-system write capabilities to create AGENTS.md and other CLI-specific shim files.
Sanitization: The instructions explicitly require the agent to extract only structured metadata (e.g., command names, config keys) and forbid echoing arbitrary text from documentation verbatim.
[PROMPT_INJECTION]: The skill's metadata description instructs the agent to 'Replace the default /init command', which is a directive to override standard platform behavior for a specific task.
[COMMAND_EXECUTION]: The skill requires the agent to execute standard discovery commands such as ls, find, and grep to analyze the repository structure and content.
[EXTERNAL_DOWNLOADS]: The skill includes reference URLs to official documentation for Claude, Gemini, and Qwen, as well as academic papers on Arxiv. These are informational references to well-known and trusted sources and do not involve remote code execution.

agentmd