The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs shell commands by directly interpolating user-provided inputs into command-line arguments.
Evidence: The command gh repo create alexanderop/{skill-name} --public --source=. --push --description "{one-line description}" in Step 4 uses the {skill-name} and {one-line description} variables.
Risk: If a user provides an input containing shell metacharacters (e.g., ;, &&, or backticks), it could lead to arbitrary command execution on the host system.
[COMMAND_EXECUTION]: The skill performs directory navigation using unsanitized user input and hardcoded absolute paths.
Evidence: The command cd /Users/alexanderopalic/Projects/mySkills/{skill-name} is used to change directories.
Risk: This pattern is susceptible to path traversal attacks if the {skill-name} variable contains parent directory references (e.g., ../). Additionally, the use of a hardcoded absolute path containing a specific username (alexanderopalic) may leak local environment details or cause the skill to fail on other systems.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting data from external files to extract metadata.
Ingestion points: In Step 1, the agent is instructed to read skill.md from a user-provided directory to extract descriptions and usage triggers.
Boundary markers: Absent; there are no instructions to use delimiters or to disregard any agent instructions that might be embedded in the read file.
Capability inventory: The skill has the ability to execute shell commands (git, gh) and perform file system operations (Read, Write).
Sanitization: Absent; the skill does not validate or sanitize the content extracted from the external skill.md before using it to populate README templates or shell command arguments.

publish-skill