The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references several external resources for documentation and tooling, including the npx skills CLI from Vercel Labs, specifications from the Agent Skills organization, and official documentation from OpenAI, Zed, and Cursor. These are well-known, trusted industry services and organizations.
[COMMAND_EXECUTION]: The skill instructions involve standard development commands such as pnpm run validate, pnpm run eval, and pnpm changeset. These are used for linting, testing, and versioning within the skill's own repository environment and do not pose a security risk in this context.
[INDIRECT_PROMPT_INJECTION]: As a tool designed to review and audit other skill files (SKILL.md), the agent ingests untrusted content from those files. While this creates a potential surface for indirect prompt injection, the risk is mitigated by the skill's specific purpose of identifying and reporting such issues during the review process. No specific boundary markers or sanitization logic is provided in the instructions, which is typical for this type of governance workflow.

skill-authoring-lifecycle