The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's primary function is to verify safety facts by generating and executing local scripts or tests. It explicitly instructs the agent to run code on the local system, specifically targeting the repo's .tmp/ directory.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of code diffs, pull requests, or proposed changes. Because these inputs inform the creation and execution of "proof scripts," there is a risk that a maliciously crafted diff could influence the agent to execute unintended commands during the verification process.
Ingestion points: Untrusted data enters the agent context through the diff, PR, or proposed change inputs defined in the SKILL.md contract.
Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within the processed diffs.
Capability inventory: The skill has the capability to create/modify files in the .tmp/ directory and execute shell commands to run tests or scripts (SKILL.md).
Sanitization: The instructions do not specify any sanitization, filtering, or validation steps for the incoming diff data before it is used in script generation.
[DYNAMIC_EXECUTION]: The skill employs a script generation and execution pattern. It instructs the agent to author proof scripts (e.g., in .py, .js, or .sh) and then execute them to observe the results, which is a form of runtime code generation.

blast-radius