The Agent Skills Directory

[COMMAND_EXECUTION]: Step 3 of the procedure executes a shell script to initialize a local scratch directory. The script uses commands such as mkdir, chmod, openssl, and id to create a randomized, owner-restricted path. This implementation follows security best practices by explicitly checking for symbolic links and verifying file ownership to mitigate directory traversal and race condition attacks.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data to generate its artifacts, creating a surface for injection attacks.
Ingestion points: Grounding material is gathered in Step 4 from repository diffs, user-supplied concepts, and the local CORPUS.md file.
Boundary markers: The instructions do not define specific delimiters or "ignore embedded instructions" warnings for the agent when processing these external sources, which could allow instructions hidden in data to influence the agent's output.
Capability inventory: The skill has the capability to write files to the temporary run directory and execute shell commands for workspace management.
Sanitization: While Step 7 includes a structural verification check for HTML and Markdown validity, it does not specify sanitization or filtering for the content gathered from grounding materials.
[DATA_EXFILTRATION]: Step 7 describes a "link check" procedure where the agent must verify that external links in the generated document resolve to live URLs. This functionality requires the agent to perform outbound network requests to arbitrary domains provided in the intake material, which represents a potential data exfiltration vector if sensitive information is appended to the URLs.

explainer-artifact