The Agent Skills Directory

[COMMAND_EXECUTION]: The skill requires the agent to execute shell commands for building QEMU, running unit tests (qtest), and executing diagnostic tools. It specifically mandates recording the exact commands used in a dedicated commands.md file and advises redacting sensitive information.
[PROMPT_INJECTION]: The instructions include a section on the 'QEMU upstream boundary' that explicitly forbids the agent from preparing or sending generated patches to official mailing lists. This serves as a safety constraint to prevent the agent from taking unauthorized actions in the upstream community.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external data, including build logs, runtime traces, and guest workload output. While this presents an indirect injection surface, the risk is mitigated by the structured reporting format required by the skill.
Ingestion points: Build, test, runtime, and diagnostic logs stored in the .oh-my-qemu/<task-slug>/logs/ directory.
Boundary markers: The instructions enforce a specific 'Reporting format' that limits the agent's output to defined classification gates (PASS, FAIL, INCONCLUSIVE).
Capability inventory: The agent is authorized to write to the local workspace, execute build systems (e.g., make), and create temporary utility scripts in a designated directory.
Sanitization: No explicit sanitization of log content is defined, but the agent is instructed to redact commands in its audit log.
[NO_CODE]: The skill does not contain any executable scripts or binaries; it consists entirely of instructional markdown and configuration metadata.

qemu-model-verification