The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses the ! shell execution syntax in the Context section to run commands at skill load time. It executes ls .claude/skills/ to identify existing verification skills and jq to extract scripts from package.json. These operations are used for environment discovery and do not target sensitive system files.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to 'interview' the repository by reading project files, including package.json, source code, and environment configurations, to determine how to launch and drive the application. This creates a surface where an attacker who can commit to the repository could embed malicious instructions that the agent might execute during the verification step.
Ingestion points: Reads package.json, $ARGUMENTS, and repository source files (referenced in Step 2 of the process).
Boundary markers: None identified; the agent is instructed to cite and use the content of files directly.
Capability inventory: Performs file writes to .claude/skills/ and executes shell commands for application launch, feature driving, and teardown.
Sanitization: No sanitization or validation logic is defined for the commands extracted from the project files.
[COMMAND_EXECUTION]: The skill instructions require the agent to execute shell commands it generates from the project's own files to 'prove' the verification skill. This includes running launch scripts and driving application features through the command line or network requests.

create-verify-skill