The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary methodology involves extracting "command" claims from Markdown files and executing them to verify documentation accuracy. This creates a significant surface for indirect prompt injection, as malicious project files can define arbitrary commands that the agent will execute during the audit process.
Ingestion points: All Markdown files within the project repository being audited, specifically SKILL.md and LOOP.md specs.
Boundary markers: The skill does not define strict delimiters or safety instructions to prevent the execution of malicious commands extracted from documents.
Capability inventory: The skill has extensive shell execution capabilities via subprocess in scripts/loop_run.py, scripts/isolation.py, and scripts/_common.py.
Sanitization: No filtering or sanitization is performed on commands extracted from audited documentation before they are passed to a shell.
[COMMAND_EXECUTION]: Multiple Python scripts execute shell commands through subprocess.run and subprocess.Popen. Notably, scripts/loop_run.py executes shell commands defined in a LOOP.md specification file via its run_shell function.
[DYNAMIC_EXECUTION]: The script scripts/path_config.py uses importlib.import_module to dynamically load modules. This pattern can be exploited if an attacker manages to influence the module name being loaded.

gsd-path-docs-audit