The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process large amounts of untrusted data from a target repository, including README files, documentation, and source code. There are no instructions for boundary markers or sanitization to prevent the agent from following malicious instructions embedded in these files.
Ingestion points: Phase 1 instructions involve reading the README, documentation, and the entire codebase.
Boundary markers: Absent; the skill does not specify using delimiters or 'ignore' instructions for the ingested content.
Capability inventory: The agent has the ability to execute shell commands (git), write files, and potentially use web search tools.
Sanitization: Absent.
[DYNAMIC_EXECUTION]: The skill explicitly instructs the agent to generate and execute code at runtime to verify its assessment hypotheses.
Evidence: In Phase 3, the instructions state: "Build probe harnesses in your working area, never inside the target repo" and "If a winner's cheapest probe can run right now... run it during this pass."
[COMMAND_EXECUTION]: The skill utilizes shell commands to inspect the project environment and run existing test suites.
Evidence: Phase 1 uses git log --oneline --stat. Phase 3 mentions "running a bundled harness against fixtures."
[DATA_EXFILTRATION]: While not directly malicious, the 'Ecosystem Watcher' lens encourages external web searches based on the project context, which can leak sensitive project details or metadata to external search engines.
Evidence: The Ecosystem lens instructions in Phase 2 note that the lens "is sharper with a web search for current context."

latent-potential