The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted markdown data from external wikis and vaults, extracting strings such as page titles and acronym definitions to include in health reports. An attacker could embed malicious instructions in these fields which the agent might follow when processing the generated report.
Ingestion points: kb_ingester.py (line 120) reads all .md files in a directory; runbook_validator.py (line 391) reads user-provided files.
Boundary markers: The generated reports do not use explicit delimiters or "ignore embedded instructions" warnings to wrap content extracted from external files.
Capability inventory: The agent context typically includes capabilities for file system modification and command execution, creating a path for injection to cause harm.
Sanitization: Extracted content (e.g., page titles, acronym definitions) is included in the final markdown report without escaping or validation against instruction patterns.
[METADATA_POISONING]: There is a discrepancy between the author name in the SKILL.md file (claude-code-skills) and the actual skill author identity (alirezarezvani). This misleading metadata can lead to incorrect assumptions about the skill's origin or official status.

knowledge-ops