The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data from multiple sources which could contain hidden instructions targeting the agent.
Ingestion points: The agent is instructed to read git commit messages, source code diffs, and other skill files (such as ../orca-harness/SKILL.md or other found verify skills).
Capability inventory: The agent has the capability to execute shell commands (to run verifiers), write to project files (models, harnesses, property files), and update its own SKILL.md instructions.
Boundary markers: No specific boundary markers or instructions to treat external data as non-executable text are present.
Sanitization: There is no mention of sanitizing or validating the content of commit messages or external skill files before processing them.
[COMMAND_EXECUTION]: The skill identifies and executes arbitrary commands defined in other project-local skills or verifier configurations.
Evidence: Step 1 instructions the agent to "collect... the command that runs it" and Step 2/Step 5 instruct the agent to "Run each check".
Risk: If a project-local verify skill or configuration has been modified to include malicious shell commands, this skill will execute them during the verification maintenance process.

maintain-formal-verification-skill