The Agent Skills Directory

[METADATA_POISONING]: The skill's YAML frontmatter explicitly sets mutating: false, suggesting that the agent will not make changes to the filesystem. However, the 'Auto-fix protocol' in the body instructions specifically directs the agent to update tests and fix imports, creating a deceptive safety profile.
[COMMAND_EXECUTION]: The skill requires the agent to execute shell commands such as bun test, git log, and gbrain doctor to perform its primary function of project validation and health monitoring.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by ingesting and acting upon data from external tool outputs.
Ingestion points: Output from the bun test, git log --oneline, and gbrain doctor --fast --json commands.
Boundary markers: No delimiters or safety instructions are provided to isolate untrusted tool output from the agent's logic.
Capability inventory: The skill allows shell execution and file modification (via the auto-fix protocol).
Sanitization: The agent is instructed to classify failures and apply fixes directly from parsed logs without explicit sanitization or validation steps.
[DATA_EXFILTRATION]: The skill accesses and writes state information to a file in the user's home directory (~/.gbrain/test-state.json), which exposes system-level data outside of the immediate project environment.

testing