The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions and workflow direct the agent to ingest the content of ARCHITECTURE.md and execute 'invariant' shell commands found within it. This creates a surface where a malicious user or a pull request contributor could insert harmful shell commands into the documentation, which the agent would then execute with its active credentials.
Ingestion points: The agent is instructed to read ARCHITECTURE.md from the repository root.
Boundary markers: There are no safety boundaries or instructions to sanitize or validate the commands extracted from the documentation.
Capability inventory: The agent is given capabilities to run shell commands, including python3 scripts/check_architecture.py, git ls-files, rg, and any custom command labeled as an 'invariant'.
Sanitization: No sanitization is performed on the extracted commands before execution.
[COMMAND_EXECUTION]: The workflow explicitly requires the agent to run commands found in code blocks within the document being audited. While the intended use is for grep-based search commands (e.g., rg), the lack of constraints allows for the execution of any command the agent's environment permits.
[SAFE]: The scripts/check_architecture.py script uses subprocess.run to call git ls-files. This is a controlled use of a local tool for repository analysis and does not constitute an arbitrary command execution risk within the script itself.

write-architecture-md