The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes multiple shell scripts based on runtime path resolution.
Step 3 in SKILL.md executes <ref>/verdict.sh <session-id>, where <ref> is a user-provided or environment-resolved directory path.
Step 5 in SKILL.md executes check.sh located in the skill's own directory.
[REMOTE_CODE_EXECUTION]: Because the <ref> parameter is intended to resolve against 'attached repositories' or checkout-relative paths, the skill facilitates the execution of arbitrary scripts (verdict.sh) from potentially untrusted or external codebases.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a high-risk indirect injection surface in Step 2.
Ingestion points: Content is read from <ref>/probe.md.
Boundary markers: None are present; in fact, the skill explicitly commands the agent to 'follow it verbatim'.
Capability inventory: The skill can spawn new sessions, attach full source repositories, and execute shell scripts.
Sanitization: No sanitization or escaping is performed; the instruction specifically overrides standard caution by mandating verbatim execution of untrusted file content.
[DYNAMIC_EXECUTION]: The skill uses dynamic path resolution to find and execute scripts (verdict.sh). The check.sh script specifically enforces that the verbatim execution instruction remains present in the SKILL.md file, acting as a validator for the unsafe prompt injection behavior.

run-probe