The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted documentation files (.md) and instructs AI agents to discover and verify claims within that content. This creates a surface for indirect prompt injection if an attacker-controlled document contains instructions intended to bypass safety filters or manipulate the agent's code analysis results.
Ingestion points: Markdown documentation files throughout the project directory, including README.md and manual files.
Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are used when passing documentation content to subagents for behavioral or architectural verification.
Capability inventory: Verification agents have access to tools including Grep, Glob, Read, and Bash, providing a broad surface if an injection succeeds.
Sanitization: The skill lacks explicit sanitization or filtering for extracted prose claims before they are interpolated into prompts for the Sonnet and Haiku models.
[COMMAND_EXECUTION]: The provided Python scripts (extract_claims.py and verify_claims.py) execute local shell commands to facilitate codebase indexing and claim verification.
Evidence: The scripts use subprocess.run to call system binaries like git (for finding project roots and analyzing commit history) and grep (for searching symbols and config keys).
Safety Context: These calls are implemented using list-based arguments without the shell, and patterns are escaped using re.escape(), which follows best practices for preventing command injection.
[EXTERNAL_DOWNLOADS]: The skill includes functionality to verify the reachability of URLs found within documentation.
Evidence: The verify_url function in scripts/verify_claims.py uses urllib.request.Request to perform HTTP HEAD requests to external domains.
Safety Context: This feature is opt-in (requiring the --check-urls flag) and is used solely for reachability checks without transmitting sensitive project data.

doc-claim-validator