The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill installs the @noble/ed25519 package from the official npm registry. This is a well-known and reputable cryptographic library used for Ed25519 signatures.
[COMMAND_EXECUTION]: The skill executes local Node.js scripts (init.mjs, regen.mjs, verify.mjs, history.mjs) to manage manifests, sign data, and verify code markers. These scripts are part of the skill's core functionality.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided configuration in witness-fixes.json and scans project source files for specific markers. This creates a surface for indirect prompt injection if malicious instructions were placed in project files, though the risk is localized to the verification process.
Ingestion points: witness-fixes.json, verification.md.json, verification-history.jsonl, and local source files targeted by markers.
Boundary markers: None explicitly defined in the prompt instructions.
Capability inventory: File system access (Read, Write, Edit) and shell execution (Bash for Node.js scripts).
Sanitization: The skill relies on the logic within the provided .mjs scripts to handle data parsing and verification.

witness