The Agent Skills Directory

[COMMAND_EXECUTION]: Step 4 of the SKILL.md file ("Verify every claim against the source") explicitly instructs the agent to execute commands extracted from the target repository's README file. Specifically, Step 4.2 states: "Execute the documented install command exactly as written, then the first usage example exactly as written." This instruction creates a significant risk that the agent will execute arbitrary and potentially malicious shell commands if the target repository is untrusted.
[REMOTE_CODE_EXECUTION]: The skill mandates a process of downloading and executing code from external, untrusted sources (the repositories being audited). While it suggests running these in a "clean state" or "container," if the agent's environment does not provide such isolation (e.g., a local CLI agent), the agent will execute these commands directly on the host system, leading to a high-severity RCE vulnerability surface.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process external, untrusted data (README files) which may contain instructions specifically designed to influence the agent's behavior.
Ingestion points: The skill reads the full content of README files from user-provided repositories (SKILL.md, Step 2).
Boundary markers: The instructions lack requirements for delimiters or warnings to ignore instructions embedded within the ingested data.
Capability inventory: The agent is granted the capability to execute shell commands found in the ingested text, read other files in the repository, and browse the web (SKILL.md, Step 2.4).
Sanitization: There is no evidence of sanitization or validation of the commands extracted from the README before they are passed to the agent's execution environment.
[METADATA_POISONING]: The references/published-findings.md and references/tooling-and-measurement.md files contain multiple hallucinated references, including a citation for "Mynampaty et al., CHI 2026" and a quote from "Mitchell Hashimoto... 12 May 2026." These future-dated, fabricated references appear to be intended to lend false authority to the skill's instructions and could lead a user to misjudge the reliability or safety of the agent's actions.

readme-optimization