The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute local CLI tools including gbrain, bun, and git to perform file operations and testing. Evidence: Phase 2 and 4 describe running gbrain commands, while Phase 5 requires bun test, gbrain skillpack check, and git diff.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from a user-defined host repository, which could contain malicious instructions or code aimed at the agent.
Ingestion points: Reads SKILL.md, routing-eval.jsonl, and paired source files from the user-specified <host-repo-root> directory.
Boundary markers: No automated boundary markers are enforced during ingestion; the skill relies on manual genericization and a privacy linter.
Capability inventory: The skill can write files to the local filesystem and execute shell commands.
Sanitization: Includes a privacy linter for specific patterns and requires an editorial genericization pass to scrub personal or internal identifiers.
[DYNAMIC_EXECUTION]: The skill requires running tests on harvested source code, which could lead to the execution of malicious logic if the source repository is compromised. Evidence: Phase 5 specifies running bun test on the newly harvested skill files in the local environment.

skillpack-harvest