The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides explicit instructions for the agent to execute shell commands to interact with a local security toolset.
Evidence: Step 4 in SKILL.md contains a bash code block that executes cd "${HOME}/mitrize" and python3 scripts/query_attack_md.py with user-supplied keywords.
[DYNAMIC_EXECUTION]: The skill depends on the execution of external Python scripts (query_attack_md.py) that are expected to exist in a specific directory on the host system but are not provided as part of the skill's own package.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external specifications and source code, which could be used to deliver malicious instructions to the agent.
Ingestion points: The SPEC_SOURCE input (which accepts URLs and file paths) and the CODEBASE_PATH input are used to populate the agent's context during the requirement extraction phase in Step 1.
Boundary markers: Absent. The skill does not define or recommend the use of delimiters or 'ignore' instructions to wrap the untrusted specification text.
Capability inventory: The skill has the capability to execute shell commands and read files from the local filesystem.
Sanitization: Absent. The workflow instructs the agent to parse text directly from the sources without performing validation or escaping of the input data.
[EXTERNAL_DOWNLOADS]: The skill references external sources for specifications and documentation.
Evidence: The skill points to RFC documents at rfc-editor.org and references a public GitHub repository from Trail of Bits in the Notes section. These are documented as references to well-known organizations and services.

spec-to-code-compliance