The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies extensively on executing shell commands and local Python scripts using uv run. A primary security concern is the on_complete configuration hook (defined in customize.toml and executed in references/report.md), which allows the execution of an arbitrary shell command string after the compilation finishes. If the configuration is sourced from an untrusted source or manipulated, it could lead to arbitrary code execution in the agent's environment.
[REMOTE_CODE_EXECUTION]: The workflow invokes npx skill-check in references/validate.md. Depending on the local environment's configuration, npx may download and execute the latest version of the skill-check package from the npm registry at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant surface for indirect prompt injection by design. It fetches and parses content from untrusted external sources to generate instructions for AI agents.
Ingestion points: references/sub/fetch-docs.md fetches content from user-provided doc_urls. references/sub/fetch-temporal.md fetches issues, pull requests, and changelogs from GitHub repositories.
Boundary markers: The skill uses markdown headers and structured provenance citations (e.g., [EXT:...], [QMD:...]) to delimit and identify the source of external content.
Capability inventory: The skill has broad capabilities, including file system modification (rm, mkdir, cp, atomic writes), arbitrary command execution via uv run and the on_complete hook, and network access via curl, wget, and specialized fetching tools like Firecrawl.
Sanitization: The skill implements a security measure in references/compile.md (Step 5 §2a) that replaces angle brackets (< and >) in frontmatter descriptions to prevent unintended XML/tag injection into the AI platform's UI or processing engine.
[EXTERNAL_DOWNLOADS]: The skill performs automated downloads of documentation and GitHub metadata using tools such as curl, wget, and the GitHub CLI (gh). While these are intended for the skill's primary purpose, they represent a connection to external, untrusted network resources.

skf-create-skill