The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests various untrusted files within the repository to inform its brief-writing process, creating a vulnerability surface.
Ingestion points: Instructions in SKILL.md (lines 18-24) direct the agent to read docs/publications/, GLOSSARY.md, docs/decisions/README.md, PRODUCT.md, and arbitrary source code within the repository.
Boundary markers: The instructions lack explicit delimiters or warnings to ignore embedded instructions within these ingested files.
Capability inventory: The skill can write files to docs/briefs/, modify GLOSSARY.md, and execute shell commands or source code (SKILL.md, line 33).
Sanitization: There are no provisions for sanitizing or validating repository content before processing or execution.
[DYNAMIC_EXECUTION]: The skill instructions explicitly mandate the execution of code found in the repository to verify technical claims.
Evidence: SKILL.md states: "When the piece makes a claim about how code, a tool, or a package behaves, read the source or run it in this repository and use what was observed."
[COMMAND_EXECUTION]: The instruction to "run it in this repository" implies the use of a shell tool to execute local scripts, which could lead to unauthorized command execution if the repository contains malicious scripts.

define-piece