The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from 'Work' artifacts, including spec.md, state.md, and evidence files. These files may contain instructions that could influence the agent's behavior during the verification process.
Ingestion points: The agent reads project-specific files like spec.md, index.md, and user-specific preferences in .devflow/team/ to determine verification steps.
Boundary markers: The instructions emphasize sticking to the defined 'canon' and contracts, which helps mitigate accidental obedience to embedded instructions.
Capability inventory: The agent has the capability to read and write files (verification.md, state.md) and is instructed to perform 'actual execution' of tests or commands.
Sanitization: The accompanying JavaScript utility (scripts/runtime/common.mjs) includes a resolveProjectPath function that implements path sanitization to prevent directory traversal attacks.
[COMMAND_EXECUTION]: The skill instructions require the agent to perform 'actual execution' and 'observation' to verify acceptance criteria. While the provided scripts include a runChild function that wraps child_process.spawn with safety limits (timeouts and output size caps), the agent is ultimately expected to run arbitrary commands as defined in the project's specifications.

verify