The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands (npm run skills:create) using user-supplied parameters for the --name and --project flags. This presents a potential command injection surface if the agent fails to sanitize these inputs before they are passed to the shell.
[PROMPT_INJECTION]: The workflow directs the agent to locate, read, and follow the instructions of an external skill file (create-skill/SKILL.md) found in directories like ~/.cursor or ~/.claude. This constitutes an indirect prompt injection surface as the agent is instructed to treat external content as authoritative for its current task. \n- Ingestion points: The agent is instructed to search for and ingest content from external skill files at paths like ~/.cursor/skills-cursor/create-skill/SKILL.md (File: SKILL.md). \n- Boundary markers: No specific delimiters or warnings to ignore embedded instructions are provided for the ingested content. \n- Capability inventory: The skill possesses the ability to execute shell commands via npm run and perform file system operations. \n- Sanitization: There is no evidence of sanitization or validation of the external instructions before the agent begins following them.

scaffold-skill