The Agent Skills Directory

[COMMAND_EXECUTION]: The skill parses a 'base-ref' value from a local plan file and interpolates it directly into a 'git diff' command. If the plan file is maliciously crafted, this could lead to command injection in the shell environment where the agent operates.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process multiple external files including 'tasks.md', 'proposal.md', 'design.md', and delta specs. These files represent an attack surface where malicious instructions could be embedded to influence the agent's verification logic or report generation. The skill lacks explicit instructions for the agent to treat these inputs as untrusted data. 1. Ingestion points: 'tasks.md', 'proposal.md', 'design.md', and the plan file path returned by 'comet state get plan'. 2. Boundary markers: None specified for the contents of these files. 3. Capability inventory: Execution of shell commands via 'git', 'comet' CLI, and project-specific build tools ('npm', 'mvn', 'cargo'); file creation and modification capabilities via state management commands. 4. Sanitization: No evidence of robust sanitization or validation for the 'base-ref' or other content read from these files before use in shell commands.
[DYNAMIC_EXECUTION]: The skill uses a 'Skill' tool to dynamically load additional skills ('verification-before-completion', 'requesting-code-review', 'openspec-verify-change') during its execution. While these appear to be part of the intended 'Superpowers' ecosystem, dynamic capability loading increases the complexity of the execution environment.

comet-verify