The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to execute 'git checkout' using the user-supplied skill name without validation or escaping. A malicious user could provide a skill name containing shell metacharacters (e.g., semicolons or backticks) to execute arbitrary shell commands.
[DATA_EXFILTRATION]: The skill constructs file paths using the user-provided skill name (e.g., .agents/skills/[name]/SKILL.md). This pattern is vulnerable to path traversal attacks, potentially allowing the agent to read or modify sensitive files outside the intended directory.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection because it reads and processes the full content of external skill files during its diagnosis phase. If a skill file contains malicious instructions designed to subvert the agent, the agent may follow them while attempting to fix the skill.
Ingestion points: .agents/skills/[name]/SKILL.md (Phase 3)
Boundary markers: Absent; there are no specific instructions to ignore embedded commands or use of protective delimiters.
Capability inventory: Read, Write, Bash, Glob, Grep.
Sanitization: Absent; the skill does not filter or validate the content of the files it processes.

skill-improve