The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions specify running various commands from within the repository, including 'package scripts', 'docs build', and 'OpenAPI generation' as part of the verification process (SKILL.md). Running code provided by an untrusted repository is a potential security risk as the scripts could perform malicious actions on the host system.
[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it reads and processes untrusted files from a repository (code, documentation, comments) and can perform sensitive actions like shell execution or file modification based on that input. * Ingestion points: The skill ingests file content and metadata from the local repository and potentially external documentation during its 'Discovery Workflow' (SKILL.md). * Boundary markers: There are no instructions or patterns provided to the agent to treat the ingested content as data only or to ignore instructions embedded within those files. * Capability inventory: The skill is capable of executing shell commands (Verification step) and writing to files ('Post-Audit Update Workflow' in SKILL.md). * Sanitization: The skill lacks mechanisms to sanitize or validate content from the repository before it is processed by the AI or used to influence command execution.

docs-sync-audit