The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in Phase 3 direct the agent to run 'bundled harnesses' and 'probes' located within the repository being analyzed. Executing scripts or binaries from an untrusted local directory can lead to arbitrary code execution on the user's system.
[DYNAMIC_EXECUTION]: The agent is encouraged to execute project-local code or tools at runtime to verify its assessment hypotheses (e.g., 'parsing a corpus with the project's own grammar, running a bundled harness against fixtures'). This dynamic execution of unverified project code poses a security risk.
[INDIRECT_PROMPT_INJECTION]: The skill processes large amounts of untrusted data, including README files, documentation, and source code comments, to perform its analysis. It lacks instructions for sanitizing this data or using boundary markers to separate instructions from the data being analyzed.
Ingestion points: Phase 1 defines the reading of documentation, code, and git logs from the target project directory.
Boundary markers: No delimiters or safety warnings are specified to prevent the agent from obeying instructions embedded in the project files.
Capability inventory: The skill utilizes file system read access and the ability to execute local commands (harnesses/probes).
Sanitization: There is no mention of filtering or validating the content read from the repository before processing it.

latent-potential