The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted Zsh code, scripts, and configuration files, which constitutes an indirect prompt injection surface. This is the primary intended purpose of the skill, and it provides extensive guidance on mitigating these risks.
Ingestion points: The agent ingests user-provided Zsh scripts, startup files (e.g., .zshrc), completion functions, and repository metadata for review and debugging as defined in SKILL.md and README.md.
Boundary markers: The instructions in SKILL.md and references/19-security.md explicitly direct the agent to treat evaluation boundaries (such as eval, source, and prompt substitution) as critical points for validation.
Capability inventory: The skill includes a utility script scripts/verify-zsh.zsh capable of executing Zsh code for smoke testing when explicitly invoked with the --smoke flag. The agent is otherwise expected to use standard file and shell capabilities.
Sanitization: The reference documentation in references/03-expansion-algebra.md and references/19-security.md provides detailed instructions on using Zsh-native expansion flags (such as (q) for quoting and (V) for sanitizing control characters) to handle untrusted input safely.

zsh-expert