The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands found in project documentation (CLAUDE.md, AGENTS.md, README.md) to verify their correctness. This allows for arbitrary command execution if an attacker can inject malicious commands into the project's documentation.
Evidence: SKILL.md (Step 3: Validate)
"Run project commands mentioned in docs to verify they work".
[INDIRECT_PROMPT_INJECTION]: The skill processes content from untrusted external sources, such as git history and documentation files, which could contain instructions intended to manipulate the agent.
Ingestion points: The agent reads CLAUDE.md, AGENTS.md, README.md, and git history logs (SKILL.md, Step 1).
Boundary markers: The skill does not define specific delimiters or provide instructions to ignore content that appears as instructions within the read files.
Capability inventory: The skill has access to Write, Edit, and Bash tools (limited to git commands), providing an impact surface if the agent follows malicious data-driven instructions.
Sanitization: No sanitization or validation steps are defined to check the safety of commands or content extracted from files before execution or persistence.

update-project