The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill operates on user-provided Swift source code and project manifests (Package.swift), which serve as ingestion points for untrusted data that could contain malicious instructions.
Ingestion points: User-provided Swift projects and configuration files are ingested during the 'Architecture Analysis' and 'Implement' phases in SKILL.md.
Boundary markers: The skill lacks explicit instructions or delimiter patterns to separate user-provided code from the agent's system instructions, potentially allowing embedded code comments to influence agent behavior.
Capability inventory: The 'Validation checkpoints' in SKILL.md instruct the agent to run swift build and swift test. These commands execute Swift code (Package.swift manifests and test suites), providing a path for arbitrary code execution if the project is malicious.
Sanitization: There is no requirement for the agent to sanitize or perform static analysis on Package.swift before execution.
[DYNAMIC_EXECUTION]: The skill workflow involves runtime compilation and execution of source code via the swift build and swift test commands as described in the SKILL.md validation checkpoints. This allows the execution of code generated or provided at runtime, which is a common pattern for developer tools but remains a security consideration when handling untrusted inputs.

swift-expert