The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill is explicitly instructed in Step 2 to run cargo test -p <crate-name> -- --nocapture on a directory provided via the $crate_path argument. Rust's cargo tool automatically compiles and executes code from the target directory, including build.rs scripts and test functions. If the target crate is malicious, this results in arbitrary code execution within the agent's environment.
[INDIRECT_PROMPT_INJECTION]: The skill implements a high-exposure data ingestion pattern.
Ingestion points: In Step 1, the agent is directed to "Read every file in the crate," including source files, Cargo.toml, and local documentation like CLAUDE.md.
Boundary markers: The instructions lack any requirement to use delimiters or to treat the file content as untrusted data that should not be interpreted as instructions.
Capability inventory: The skill has access to Bash, Write, and Edit tools, allowing it to execute system commands and modify the local filesystem.
Sanitization: There is no mention of sanitizing or escaping the content of the files before they are processed by the LLM, leaving the agent vulnerable to instructions embedded within the code or comments of the audited crate.
[COMMAND_EXECUTION]: The skill leverages the Bash tool to perform system-level operations such as running the Rust compiler and test runner. This capability, combined with the processing of untrusted crate paths, increases the risk of command injection or malicious execution if the crate name or path contains shell metacharacters that are not properly handled.

review-crate