The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill describes an architecture where an agent processes untrusted external data (file paths and CLI arguments), which represents a potential surface for indirect prompt injection.
Ingestion points: The documentation includes functions like read_config(path: str) and validate_dir(path: str) in SKILL.md that accept string inputs from the LLM client.
Boundary markers: The skill provides explicit security warnings, stating "Treat all tool I/O as untrusted (prompt injection)" and advising that "every input is untrusted."
Capability inventory: The examples demonstrate powerful capabilities including file system reads (Path.read_text) and subprocess execution (subprocess.run).
Sanitization: The instructions prioritize security by recommending path validation (checking for absolute paths), use of shlex.split, and avoiding shell=True to prevent command injection.
[COMMAND_EXECUTION]: The skill provides templates for executing system commands via the Python subprocess module. It pro-actively mitigates execution risks by instructing users to avoid shell interpolation and use argv lists for safety.

building-python-mcp-servers