The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data to modify local instruction files and configurations, creating a significant attack surface.
Ingestion points: Step 2 in SKILL.md explicitly accepts raw sources such as external URLs, remote repositories, and conversation transcripts.
Boundary markers: There are no defined delimiters or instructions to ignore embedded commands within the ingested sources.
Capability inventory: The skill can read local artifacts (docs, configs, codebases), invoke the study tool on external content, and write/apply changes to local files (Steps 1, 2, and 5 in SKILL.md).
Sanitization: The skill lacks security sanitization, relying instead on a qualitative "grading" process by the model based on "fit" and "evidence".
[EXTERNAL_DOWNLOADS]: The workflow requires fetching content from arbitrary, user-provided remote locations.
Evidence: SKILL.md Step 2 states it will "Accept raw sources (URLs, repositories, files...)".
[DATA_EXFILTRATION]: The skill accesses and processes sensitive local files which could be exposed if the analysis tool or the agent's context is compromised by a malicious source.
Evidence: SKILL.md Step 1 identifies targets such as "config" and "codebase module" for reading and analysis.
[COMMAND_EXECUTION]: The skill performs file system modifications and version control operations based on analysis of external data.
Evidence: SKILL.md Step 5 describes applying picked changes and performing git commits ("Commit only when asked").

learn-from