The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process content from untrusted external repositories, creating a surface for indirect prompt injection.
Ingestion points: The skill clones repositories from arbitrary URLs to ~/.cache/explored-repos and explicitly instructs the agent to read, grep, and explore their contents.
Boundary markers: There are no instructions or boundary markers defined to help the agent distinguish between its own system instructions and potentially malicious instructions embedded within the files of the cloned repository.
Capability inventory: The skill utilizes file system commands (mkdir, ls, find, grep) and git operations (git clone, git remote). The instructions allow for additional commands (install, build, test) if the agent deems them necessary to answer a query, increasing the risk profile if the agent is manipulated.
Sanitization: No sanitization or filtering of the repository content is performed before the agent processes it.
[COMMAND_EXECUTION]: The skill performs shell command execution to manage the repository lifecycle.
Evidence: Uses mkdir -p ~/.cache/explored-repos, git clone <URL>, and git -C <candidate> remote get-url origin to find and manage local checkouts. While these are functional, they involve executing commands based on external repository metadata.

exploring-repo