The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) because it ingests and processes untrusted skill prompt content and has the capability to write modifications back to the file system.
Ingestion points: The skill reads the content of an external SKILL.md file specified via the $ARGUMENTS parameter (e.g., in the 'Before the loop' and 'Loop protocol' sections).
Boundary markers: There are no explicit delimiters or instructions to the agent to treat the target file's content as untrusted data or to ignore embedded instructions within that content.
Capability inventory: The skill possesses file-read, file-write, and directory-creation capabilities (e.g., creating versions/ directories, writing SKILL.md, and writing VERSIONS.md).
Sanitization: No sanitization or escaping of the ingested prompt content is performed before processing or writing it back to the file system.
[COMMAND_EXECUTION]: The skill instructs the agent to perform multiple file system operations, including reading, copying, and modifying files.
Evidence: Instructions include copying the current SKILL.md to a snapshot file (e.g., copy current SKILL.md -> <target-dir>/versions/v<N>-pre.md) and applying 'surgical fixes' to specific lines in the source file.
[PROMPT_INJECTION]: The skill is susceptible to path traversal/injection through the user-provided $ARGUMENTS parameter.
Evidence: The skill uses $ARGUMENTS directly in file path resolution (e.g., ~/code/deren-skills/skills/rick/$ARGUMENTS/SKILL.md). A crafted argument containing directory traversal sequences (e.g., ../) could allow the agent to access or modify files outside the intended skill directory hierarchy.

rick-improve