The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill utilizes an LLM-based review checkpoint (AH-40) to analyze repository documentation for consistency with the code implementation. This process is susceptible to indirect prompt injection if an attacker embeds adversarial instructions in files such as AGENTS.md or docs/ARCHITECTURE.md intended to influence the agent's findings or subsequent actions.
Ingestion points: Ingests contents of AGENTS.md, docs/ARCHITECTURE.md, and other project documentation into the LLM context for consistency verification.
Boundary markers: The LLM prompt does not utilize specific delimiters or explicit instructions to ignore embedded commands within the analyzed documentation content.
Capability inventory: The skill has access to shell execution via Bash, file system modification, and network operations through git and gh tools.
Sanitization: No content sanitization or instruction filtering is performed on the documentation files before they are processed by the LLM.
[REMOTE_CODE_EXECUTION]: The script scripts/run-shipped-checkpoints.sh is designed to download and execute validation logic (checkpoints) from remote git repositories. By default, it retrieves the official assessment runner from the vendor's repository (netresearch/automated-assessment-skill). This mechanism is a documented feature for shared validation but involves the execution of code based on project-level configuration.
[PRIVILEGE_ESCALATION]: Several CI workflow templates (e.g., templates/harness-checkpoints.yml.tmpl) contain commands that use sudo to install packages like jq and yq and configure system-level binary paths. These operations are intended for environment initialization within a CI runner context.
[COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to run shell utilities, git, and make. These commands are used to perform structural audits, check for reference integrity, and manage repository state as part of the intended harness verification functionality.

agent-harness