The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The repository inspection script creates a surface for instructions embedded in project files to reach the agent's context.
Ingestion points: The scripts/inspect-project.py script traverses the repository and reads the contents of Kotlin (.kt), Gradle (.gradle, .gradle.kts, gradle.properties), definition (.def), and Apple-specific configuration files (Podfile, Package.swift, .podspec).
Boundary markers: While the output is formatted as JSON, the skill does not implement specific boundary markers or instructions to treat the extracted file content as untrusted data.
Capability inventory: The skill enables an agent to perform local environment inspections and suggests build configurations, which typically involves shell command execution (e.g., via Gradle) in a developer environment.
Sanitization: The inspection script uses regex for data extraction but lacks sanitization or escaping of the raw strings found in the project files.
[METADATA_POISONING]: The skill metadata contains deceptive and inconsistent information regarding its origin.
Evidence: The createdBy field specifies "github-copilot/gpt-5.6-sol", a non-existent language model version, and the createdAt date is set to August 2026. This misleading metadata represents a deceptive attribution pattern.

kotlin-native-apple-interop