The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill establishes a trust relationship where local repository scripts are treated as authoritative and executed automatically to repair the environment.
Ingestion points: The agent reads and executes scripts found at bin/setup, bin/bootstrap, script/setup, or Makefile within the project repository.
Boundary markers: No boundary markers or "ignore embedded instructions" warnings are used; the agent is explicitly told these scripts are authoritative.
Capability inventory: The skill uses the Bash tool to execute the identified scripts and the Read tool to inspect files.
Sanitization: There is no sanitization or verification of the script content before execution, allowing a malicious repository to execute arbitrary code via a compromised bootstrap script.
[COMMAND_EXECUTION]: The skill uses the Bash tool to run local scripts found in the repository (bin/setup && <original failing command>). While this is the intended purpose, it involves executing unverified local code that is not part of the skill's own distribution.

wk-workstyle-rails