The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is instructed to ingest and process data from untrusted external sources, creating a surface for indirect prompt injection attacks.
Ingestion points: In SKILL.md, the agent is directed to "Inspect the supplied brief, repository, live page, analytics, search data, customer language, product states, existing brand tokens, and reference sites."
Boundary markers: The instructions do not include specific delimiters or warnings to ignore or sanitize embedded instructions within the ingested content.
Capability inventory: The agent is granted the capability to "Run the repository's build, typecheck, lint, and relevant tests" and to "Implement within the project" as specified in SKILL.md.
Sanitization: There is no mention of sanitizing or validating the external data before it is processed or used in shell commands.
[COMMAND_EXECUTION]: The skill requires the agent to execute shell commands to interact with the project's build and testing systems.
Evidence: SKILL.md instructs the agent to "Run the repository's build, typecheck, lint, and relevant tests." This allows for the execution of code defined within the repository's configuration, which could be malicious if the repository is untrusted.

landing-page