The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from other agent skills and repositories, which can lead to indirect prompt injection if those files contain malicious instructions.
Ingestion points: The skill reads SKILL.md, agents/openai.yaml, and other resources from a target skill folder, as well as repository documentation like AGENTS.md, CONTRIBUTING.md, and package manifests.
Boundary markers: There are no explicit instructions to use delimiters or ignore embedded instructions when reading external skill content.
Capability inventory: The skill has the capability to modify local files (in 'Cut' mode) and execute shell commands (in the 'Validate' step).
Sanitization: There is no mention of sanitizing or validating the content of the external files before processing them or executing commands found within them.
[COMMAND_EXECUTION]: The skill instructs the agent to find and run validation or lint commands defined in external files such as AGENTS.md or package manifests.
Evidence: Step 6 (Validate) explicitly tells the agent to "Find the repository's skill checks: a validator or lint command named in AGENTS.md, CONTRIBUTING.md, or the package manifest".
Risk: While the skill includes a warning to "Never invent a command," an attacker could place a malicious command in one of these files, which the agent might then execute during the audit process.

cutting-skills