The Agent Skills Directory

[SAFE]: The skill is designed for static analysis of state models. It lacks the capability to perform network operations, file system modifications, or arbitrary command execution, which significantly minimizes its attack surface.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied descriptions of state models, which constitutes an indirect prompt injection surface. This is assessed as safe due to the lack of exploitable capabilities.
Ingestion points: User-provided "material," "state models," and "requirements" processed via the instructions in SKILL.md and prompts/state-transition-testing.md.
Boundary markers: The skill enforces a mandatory "six-part input audit" (known, missing, conflicting, stale, out_of_scope, and assumptions) which acts as a structural boundary to prevent the agent from blindly following instructions embedded in the input material.
Capability inventory: The skill is restricted to generating text/markdown findings (STT-##). It has no access to tools for network exfiltration, file writing, or subprocess execution.
Sanitization: The skill contains explicit instructions to "do not invent states or events" and "do not edit requirements, code, test assets, or target systems," which provides a policy-based defense against injection attempts designed to alter the agent's behavior.
[COMMAND_EXECUTION]: The skill does not contain any shell commands, scripts, or instructions that trigger command execution. Evaluation configuration in evals/local-rules.json specifically sets max_escalations: 0 and max_commands: 20, providing additional platform-level constraints.

state-transition-testing