The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted markdown files (skills or rules) to generate prompts and executable scenarios.
Ingestion points: scripts/run.py accepts file paths to external skills or rules for analysis.
Boundary markers: Prompt templates in the prompts/ directory use triple-dash (---) delimiters to wrap injected content.
Capability inventory: The skill executes shell commands via subprocess.run and interacts with the claude CLI.
Sanitization: Although the skill uses shlex.split and performs path traversal checks in _safe_sandbox_dir, it does not validate the content or security of the AI-generated scenarios.
[COMMAND_EXECUTION]: The skill dynamically generates and executes shell commands (setup_commands) within a sandbox environment.
Evidence: In scripts/runner.py, the skill executes commands generated by an LLM in scripts/scenario_generator.py. These commands are derived directly from the content of the target skill being analyzed, allowing for potential manipulation by a malicious source file.
Subprocess calls: Multiple modules (classifier.py, runner.py, scenario_generator.py, spec_generator.py) utilize subprocess.run to invoke external system tools, including git and the claude CLI.

skill-comply