The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the target repository to determine which commands to execute. An attacker who can commit to a repository can specify malicious commands in configuration files that the skill will run. * Ingestion points: The skill reads package.json, Makefile, justfile, Cargo.toml, go.mod, gradlew, pom.xml, pyproject.toml, and GitHub Actions workflow files during the command discovery phase. * Boundary markers: The skill does not employ boundary markers or specific "ignore instructions" prompts when reading these external configuration files. * Capability inventory: The skill is capable of executing arbitrary shell commands through its Execute workflow, specifically for the install, build, typecheck, lint, and test rungs. * Sanitization: There is no evidence of sanitization, filtering, or validation of the command strings extracted from the repository configuration files before execution.
[COMMAND_EXECUTION]: The skill's primary function is to execute shell commands discovered within the target repository.
[DYNAMIC_EXECUTION]: The skill dynamically constructs and executes commands (tagged as source: reconstructed) when explicit scripts are not found in the repository configuration.

verify-changes