The Agent Skills Directory

[COMMAND_EXECUTION]: The primary function of the skill is to generate and execute shell commands to "start, operate, observe, and clean up" applications. This includes driving UIs (Playwright/Cypress), executing CLI tools, and making API requests. The agent is instructed to perform these actions directly within the user's project environment.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant ingestion surface for indirect prompt injection. It determines verification "facts" by reading untrusted data from the local repository, including README files, package scripts, startup documentation, and existing test suites.
Ingestion points: Project root files (README.md, package.json, etc.), source code, and existing test scripts (SKILL.md, Section 1).
Boundary markers: The instructions do not define clear boundary markers or isolation for the ingested repository content.
Capability inventory: The skill allows for arbitrary shell command execution, file system modifications (writing new skill files and artifacts), and network access via the verification tools it utilizes.
Sanitization: While the skill advises against hardcoding secrets and suggests masking sensitive API requests, there is no formal sanitization or validation of the ingested strings before they are incorporated into generated executable commands.
[DYNAMIC_EXECUTION]: The workflow involves a "Run and Calibrate" phase where the agent is required to execute the newly generated verification instructions to ensure they work as intended. This process of generating code and immediately executing it poses a risk if the generated logic is influenced by malicious repository content or incorrect model reasoning.

create-verification-skill