The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions specify a fallback mechanism to execute npx clean-room-skill@latest if the tool is not found on the system path. This pattern involves downloading and running code from a public package registry at runtime without version pinning or integrity verification.
[EXTERNAL_DOWNLOADS]: The use of the npx command facilitates the retrieval of the clean-room-skill package from the npmjs.com service.
[COMMAND_EXECUTION]: The skill directs the agent to perform various shell and script executions, including:
python skills/clean-room/scripts/build_source_index.py for indexing source code.
python skills/clean-room/scripts/build_visual_index.py for visual evidence processing.
Execution of clean-room-skill run for role management and process dispatch.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing local data files without explicit safety boundaries:
Ingestion points: The agent is instructed to read task-manifest.json, preflight-goal.json, .clean-room/local-state.json, and source-index.json.
Boundary markers: The instructions lack requirements for explicit delimiters or specific warnings to ignore embedded instructions within these ingested files.
Capability inventory: The agent possesses capabilities to execute shell commands, run Python scripts, and perform filesystem operations (e.g., writing to ~/Documents/CleanRoom/), which could be targeted by instructions hidden in data.
Sanitization: While the text mentions 'sanitized artifacts', it lacks concrete requirements for input validation, schema enforcement, or filtering of the ingested content to prevent instruction injection.

unattended