The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions include the use of shell commands for file management and validation.
Specifically, the "Deprecation & Renaming" section directs the agent to use rm -rf to remove skill directories.
It also specifies running workspace commands such as pnpm run validate and pnpm run eval.
[EXTERNAL_DOWNLOADS]: The skill documentation includes commands to download and install external skill packages.
It references the use of npx skills add to fetch the skill_steward package from the author's GitHub repository.
The sources section links to external documentation and specifications from trusted organizations like Vercel and OpenAI, as well as well-known developer services.
[PROMPT_INJECTION]: The skill's workflow involves processing untrusted external files, creating a surface for indirect prompt injection.
Ingestion points: The skill is designed to analyze files matching the patterns skills/**/SKILL.md and **/SKILL.md (specified in the frontmatter paths).
Boundary markers: There are no explicit instructions to use delimiters or ignore embedded instructions when reading these files to differentiate user input from system guidance.
Capability inventory: Across its lifecycle phases, the skill employs file deletion (rm -rf) and local script execution (pnpm).
Sanitization: The skill lacks validation or escaping steps for the content of the files it audits.

skill-authoring-lifecycle