The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface by ingesting instructions from external, potentially untrusted sources to drive its logic.
Ingestion points: Processes docs/verification/manual-test-guide.md, project metadata files (README.md, package.json, pyproject.toml, Makefile, compose files), and external web content via opencli.
Boundary markers: While it looks for specific structured verbs (e.g., open, run, curl), there are no explicit security boundaries or warnings to prevent the agent from following malicious instructions embedded within these files.
Capability inventory: The agent has access to generic command execution (run), network requests (curl), and browser automation (opencli), creating a path for automated exploitation if the input files are compromised.
Sanitization: The skill does not mention sanitizing or validating the commands parsed from the manual test guides or project files before execution.
[COMMAND_EXECUTION]: The core functionality of the skill involves parsing and executing arbitrary CLI commands extracted from local files. In "Manual Test Guide" mode, it executes steps defined under structural markers. In "Repository Inference" mode, it automatically detects and runs startup and test commands from project configuration files, which could lead to the execution of malicious scripts if the repository is untrusted.
[DATA_EXFILTRATION]: The skill performs broad reconnaissance of the local environment to "collect facts," including reading configuration files like docker-compose files which often contain sensitive environment variables. These facts are then compiled into a Markdown report, which could be exfiltrated if the agent is subsequently directed to upload or send the report externally.

verify-run