The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from local project files (e.g., task.txt, target.json, verifier-result.log) through its collectors. This data is used to make decisions and is interpolated into reports, creating a surface where malicious content in project files could influence agent behavior.
Ingestion points: collectors/index.mjs reads multiple project-level state files from the working directory.
Boundary markers: Data is processed via a formal logic specification rather than raw interpolation.
Capability inventory: The skill possesses the ability to execute git commands and perform file operations for logging and artifact management.
Sanitization: Employs an AST-level validator (scripts/skill-rails/ast-policy.mjs) and path policy to restrict logic execution.
[DYNAMIC_EXECUTION]: The framework dynamically imports and executes logic from spec.mjs. This execution is restricted by a strict sandbox that blocks dangerous globals like process, fetch, and require, reducing the risk of arbitrary code execution.

evidence-credit