The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill requires the agent to generate a project-local skill and immediately execute its instructions to "prove" the generated output ("Run its own instructions end to end once"). This runtime execution of agent-synthesized code based on external repository logic presents a risk of executing unintended commands.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it derives its driving instructions from an analysis of the repository's files.
Ingestion points: The agent parses README files, package scripts, and source code to identify application entry points.
Boundary markers: The instructions lack guidance for the agent to identify and ignore adversarial instructions that might be embedded in the repository to manipulate the generated skill.
Capability inventory: The generated skill is explicitly designed to execute shell commands and perform browser/PTY automation.
Sanitization: No sanitization process is defined for logic extracted from the repository before it is incorporated into the execution steps.
[COMMAND_EXECUTION]: The skill facilitates the execution of shell commands for launching the target application and performing diagnostics. Because these commands are dynamically generated based on the agent's interpretation of untrusted repository content, it may lead to the execution of harmful commands during the mandatory verification phase.

create-verification-skill