The Agent Skills Directory

[COMMAND_EXECUTION]: The skill explicitly directs the agent to execute shell commands and code blocks extracted from the target repository to verify documentation accuracy. This involves running potentially malicious installation scripts or code examples using local system tools.
Evidence: Instructions in the 'Verify' section state to 'Run installation and the minimal usage path' and 'Validate code blocks using the project's compiler, interpreter, linter, or doctest path'.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external repositories and has high-privilege capabilities (execution and network access), creating a significant attack surface for indirect prompt injection.
Ingestion points: The agent reads README files, manifests, source code, CI configuration (e.g., GitHub Actions), and license files from target repositories.
Boundary markers: The skill does not provide instructions for the agent to use delimiters or specific ignore-rules when processing content that might contain embedded instructions.
Capability inventory: The agent is permitted to execute commands, write files, and access the network during the audit process.
Sanitization: While the skill mentions using a 'clean temporary environment' and avoiding the publication of secrets, it does not specify methods for sanitizing or escaping the untrusted commands before execution.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to verify external links and metadata provided in the audited documentation.
Evidence: The agent is instructed to 'Check relative links, anchors, referenced files, images, badge endpoints, and external documentation links with available tooling.'

readme