The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to utilize shell access (Bash) for repository orientation, dependency installation, and executing build/test cycles. This level of access allows the agent to execute arbitrary code contained within the target repository's build scripts or test suites.
[EXTERNAL_DOWNLOADS]: The skill explicitly commands the agent to install dependencies using 'npm' or 'pip', which involves downloading and executing third-party code from public package registries. This introduces a supply chain risk if the repository contains malicious dependency configurations.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its processing of untrusted project data. 1. Ingestion points: The plan file, repository source files, AGENTS.md, and CLAUDE.md. 2. Boundary markers: Absent; the skill reads these files in full as primary requirements. 3. Capability inventory: Bash, Write, Edit, WebFetch, and WebSearch tools are available to the agent. 4. Sanitization: Absent; there is no instruction to escape or validate the contents of the ingested files before the model acts upon them. This creates a risk where malicious instructions embedded in project files could override the agent's behavior.

player