The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's core workflow involves reading and parsing improvement-plan-*.md files and applying suggested content to local files, including documentation and executable scripts. This creates a risk where a malicious plan could inject dangerous code or instructions into the skill's file structure.\n
Ingestion points: The skill reads improvement-plan-{name}.md files from the working directory as specified in the SKILL.md workflow and references/plan-format.md.\n
Boundary markers: The instructions do not define boundary markers or explicit safety guidelines to prevent the agent from executing instructions embedded within the untrusted plan data.\n
Capability inventory: The skill possesses file-writing capabilities via the Edit and Write tools and shell execution capabilities, allowing content from the plan to be persisted and run.\n
Sanitization: There is no evidence of content sanitization or validation to ensure the suggested updates do not contain malicious payloads.\n- [COMMAND_EXECUTION]: The skill executes local shell scripts for backup and verification operations as part of its standard workflow.\n
Evidence: SKILL.md instructs the agent to run scripts/backup-skill.sh and scripts/verify-update.sh during the update process.\n
Behavior: The scripts utilize common shell utilities (cp, mkdir, grep, sed, yq) to manage and validate skill files.\n- [DYNAMIC_EXECUTION]: The skill workflow involves modifying script files and subsequently executing them, which constitutes runtime code modification.\n
Evidence: In SKILL.md, Step 5 applies changes to files (which can include the scripts/ directory), and Step 6 executes the verify-update.sh script to confirm the updates.\n
Behavior: This pattern allows the skill to modify its own verification logic at runtime based on the contents of the improvement plan.

skill-improver