The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves scanning the local repository's codebase (including Makefile, package.json, and README.md) to extract build and startup instructions. This creates a surface where a malicious repository could embed harmful commands in standard configuration files that the agent will subsequently execute.
Ingestion points: The agent is instructed to "Interview the repo" by reading the codebase to find surface, run, and drive commands.
Capability inventory: The skill performs subprocess execution to build, launch, and verify the application, as well as managing ports and data directories.
Boundary markers: There are no instructions to sanitize or validate the extracted commands, nor are there delimiters to separate instructions from untrusted repository data.
Sanitization: No validation logic is present to ensure that the commands identified in the codebase are safe before they are executed in the "Prove the generated skill" phase.
[COMMAND_EXECUTION]: The skill requires the agent to execute arbitrary shell commands for application lifecycle management. This includes building binaries, installing dependencies, and running "doctor" checks and "drive" actions. These commands are dynamically sourced from the project context, which poses a risk if the project contains malicious configurations.
[DYNAMIC_EXECUTION]: The skill follows a pattern of "Script generation + execution." It generates a new agent skill (.agents/skills/verify-<app>/SKILL.md) based on its findings and then explicitly instructs the agent to execute that generated skill to prove it works. This runtime execution of generated instructions from untrusted project data is an inherent risk.

create-verification-skill