The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill interviews the local repository (scripts, READMEs, Makefiles) to generate verification instructions. This creates a surface for indirect prompt injection where malicious instructions embedded in the codebase could influence the agent's behavior.
Ingestion points: Repository files, including package scripts, Makefiles, and README quickstarts, are analyzed to determine startup and drive commands (SKILL.md, Section 1).
Boundary markers: The instructions do not specify the use of delimiters or boundary markers to isolate ingested content from agent instructions.
Capability inventory: The skill is capable of writing files to the .agents/skills/ directory, executing subprocesses for building and launching applications, and driving UI/CLI harnesses (SKILL.md, Sections 2 and 4).
Sanitization: There is no evidence of sanitization or escaping of the content ingested from the repository before it is used to generate executable instructions.
[DYNAMIC_EXECUTION]: The skill follows a pattern of generating a new project-local skill (SKILL.md) and immediately executing the instructions within it to prove its functionality. Generating and then executing instructions derived from an external codebase is a vector for executing commands that may not have been explicitly reviewed by the user.
[COMMAND_EXECUTION]: The skill requires the agent to execute shell commands discovered within the repository to launch, build, and test the application. This involves running dev commands, install scripts, and health checks as defined by the codebase being analyzed.

cursor-create-verification-skill