The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/runner.py executes shell commands provided in setup_commands, which are dynamically generated by an LLM in scripts/scenario_generator.py based on the target skill's content.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided Markdown files by interpolating their raw content directly into LLM prompts in scripts/spec_generator.py and scripts/scenario_generator.py. A maliciously crafted skill file could inject instructions to manipulate the generated compliance specs or test scenarios.
Ingestion points: The generate_spec and generate_scenarios functions read the target skill file from a user-provided path.
Boundary markers: The prompts use simple triple-dash (---) separators, which provide weak isolation against adversarial content.
Capability inventory: The skill has the ability to execute shell commands via subprocess.run, including package managers and file system modifications.
Sanitization: No sanitization or escaping is applied to the content read from the target skill files before prompt interpolation.
[COMMAND_EXECUTION]: Multiple scripts, including runner.py, classifier.py, and spec_generator.py, use subprocess.run to execute the claude CLI and various system utilities.
[REMOTE_CODE_EXECUTION]: The ALLOWED_SETUP_EXECUTABLES whitelist in scripts/runner.py explicitly permits npm, pip, and pip3. If an attacker-controlled skill file successfully influences the scenario generation process, it could trigger the installation and execution of malicious code from remote package registries.

skill-comply