The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses various shell commands including git, rg (ripgrep), du, and find to manage, search, and monitor the local repository cache at ~/.repos.
[EXTERNAL_DOWNLOADS]: The workflow involves fetching external source code via git clone from URLs identified by the agent or provided by the user, which allows the agent to download content from any reachable Git repository.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to read and process content from untrusted external repositories. This creates a surface for indirect prompt injection where malicious instructions hidden in the code or comments of a cloned repository could attempt to manipulate the agent's behavior or exfiltrate information.
Ingestion points: File content, commit history, and metadata from external repositories cloned into ~/.repos (defined in SKILL.md).
Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions when reading external content, increasing the risk of the agent accidentally following embedded instructions.
Capability inventory: The agent can read files, search content across the repository, and potentially execute build scripts as indicated in the workflow.
Sanitization: There is no mention of sanitizing or validating the source code or build configuration before it is processed or executed.
[DYNAMIC_EXECUTION]: The skill instructions (Step 6) suggest that the agent may perform 'builds' or edits in isolated worktrees. Executing build systems (e.g., make, npm, cmake) on untrusted code constitutes dynamic execution of potentially malicious scripts provided by the external source.

explore-repo