The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill clones and searches external, untrusted repositories. This creates an attack surface where malicious instructions embedded in a repository could influence the agent's behavior during the search or aggregation phase.
Ingestion points: Cloned repository files are searched locally as described in SKILL.md (Section 2) and prepare.md.
Boundary markers: While SKILL.md mentions a "write boundary" and "read-only search," there are no explicit instructions to ignore instructions found within the processed data.
Capability inventory: The skill utilizes shell command execution (git), network access (cloning), and file writing (persisting to AGENTS.md).
Sanitization: prepare.md includes URL normalization logic to standardize origin comparison, which helps mitigate some input-related issues.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands (git clone, git pull) to manage repositories. This is a functional requirement but relies on the agent safely handling user-provided URLs.
[EXTERNAL_DOWNLOADS]: The skill uses git clone to download repository data from external URLs to the local environment. This is the primary function of the skill but involves fetching untrusted content from the network.

box